How to secure your Discord bot and its permissions
A Discord bot is a member of your server with a badge on it, and often with power ordinary members do not have. That power makes it useful, and also a target. If someone takes control of your bot, they act with all its permissions. Most bot security comes down to three questions: what can the bot do, who can control it, and what happens when something goes wrong?
Give it the least permission it needs
When you invite a bot, you choose its permissions. Every box you tick is power an attacker would get too.
- Never grant Administrator unless there is truly no other way. It overrides all channel restrictions and allows everything.
- Pick specific permissions. A music bot needs to connect and speak in voice channels. A welcome bot needs to send messages. Neither needs to ban members or manage roles.
- Review them from time to time. Features get removed, and old permissions stay behind.
- Check the role position. A bot can only manage roles below its own highest role, so keep its role low, and well below your admins.
Limit where the bot works
Permissions can be set per channel. Deny the bot access to channels it has no business in, such as staff chat and logs. If a bot token leaks, the attacker is then limited too.
Protect the token
The token is the master key. Never write it in your code, never post it and never share it, as covered in How to create a Discord bot and keep its token safe. Store it as an environment variable, as in Environment variables and keeping your bot token safe. Reset it immediately if you think it leaked.
Control who can run dangerous commands
Check permissions inside your code, not only through Discord's interface:
- Before a ban, kick, role change or deletion, confirm that the user running it really has the right.
- Check that the bot itself is allowed to perform the action, and that the target is below the user in the role order.
- Restrict developer-only commands, such as evaluating code or shutting down, to your own user ID. Better still, do not include commands that run arbitrary code at all.
A command that lets anyone run code on your host is a complete handover of the machine.
Validate input
Treat everything members send as untrusted:
- Use parameterised database queries so text cannot become a command. See How to use a database with your Discord bot.
- Do not pass user input to a shell command or to
eval. - Limit lengths and check types before using values.
- Be careful with commands that fetch a URL for the user, because a request to an internal address could expose private information.
Protect your host and accounts
The bot is only as safe as where it runs, and who can change it.
- Use a strong, unique password and two-factor authentication for your hosting and Discord accounts. See Enable two-factor authentication (2FA) and passkeys and Keep your NGP Cloud account secure.
- Give panel access only to people who need it, using subusers with limited rights. See How to add or remove subusers on your server.
- Keep your code in a private repository, and never commit secrets.
- Keep libraries updated, because security fixes land in updates. Check for outdated packages regularly.
Be careful with dependencies
Third-party packages run with your bot's power. Prefer well-known libraries, check that a package name is spelled correctly, since fake packages with similar names exist, and avoid installing something just because a random post suggested it.
Watch for abuse
Know what your bot does with members' data:
- Store only what you need, and delete it when it is no longer needed.
- Do not share data between servers without a reason.
- Tell your community what the bot collects.
Keep a log of important actions such as bans and role changes, so you can audit them later. See Logging and monitoring your Discord bot.
If the bot is compromised
Signs: messages you did not write, new channels or webhooks, roles changing, or the bot online when you stopped it.
- Reset the token immediately.
- Remove the bot from servers if you cannot be sure it is safe.
- Check the audit log of each server for actions you did not make, including new webhooks.
- Change passwords on your hosting and related accounts.
- Look for changes in your code and your host's files.
- Find the cause, whether a leaked token, a weak account or a flawed command, and fix it before restoring.
A quick security review
| Check | Done? |
|---|---|
| No Administrator permission | |
| Token only in environment variables | |
| Dangerous commands check permissions in code | |
No eval or shell commands from user input | |
| Parameterised queries | |
| 2FA on hosting and Discord | |
| Dependencies up to date | |
| Logs record important actions |
Go through it every few months. Small habits keep a bot safe for years.
Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.