Server Security & Secrets

Security is part of server maintenance, not a one-time install step.

Protect secrets

Never publish license keys, database credentials, Discord tokens, webhooks, API tokens, SSH private keys, or session secrets.

Use least privilege

Give staff, database users, deployment keys, and automation only the permissions they require.

Use unique passwords

Do not reuse the same password for hosting, Git, Discord, email, and databases. A password manager can help generate and store unique credentials.

Use MFA

Enable multi-factor authentication on hosting, Git providers, email, Discord, and other administrative accounts where supported.

If a secret leaks

Rotate/revoke it. Deleting the visible line from a repository does not make a previously committed credential safe.

Success check

No production credential is in a public repository, screenshots, shared chat logs, or documentation.

Document status

Last reviewed: September 2026
Version note: Use the instructions that match your installed product/resource version. When behavior differs from your release, check its release notes before changing production configuration.