Security Best Practices
Token Security
Monitor heartbeat tokens grant permission to report telemetry for your monitored bot. Protect them with the same care as API keys.
NEVER DO THIS
- Never commit tokens to public or private Git repositories.
- Never put tokens into client-side browser JavaScript.
- Never paste tokens into public Discord channels or support tickets.
- Never expose raw tokens in unauthenticated debug logs.
- Never share a single token across multiple distinct bots.
RECOMMENDED PRACTICES
- Store tokens securely in environment variables (e.g.
.env). - Rotate tokens immediately if accidentally exposed.
- Revoke unused tokens when decommissioning a bot.
- Use dedicated tokens generated per monitored bot ID.
Server-Side SHA-256 Storage
Monitor does NOT store your raw heartbeat token. When you generate a token, Monitor hashes it with SHA-256 and only persists the cryptographic hash. Once generated and displayed to you, the raw token cannot be retrieved from Monitor again.