Never share secrets
- Discord bot tokens
- Mailbox passwords
- API keys
- Session cookies
- Database passwords and URLs
- Private SSH or SFTP credentials
If a secret leaks
- 1Rotate or reset the exposed secret at its source immediately.
- 2Update the new value on your hosted application.
- 3Restart the application if it only reads environment values at startup.
- 4Remove the exposed value from public code, screenshots, logs, or messages where possible.
Use backups before destructive changes
Security also means recoverability. Before reinstalling, replacing a project, deleting mail, or changing major configuration, keep a backup or independent copy of data you cannot recreate.
Support will not need your password
Support can ask for your account, server name, domain, and error details. Do not send passwords, tokens, or private keys in a ticket.