Credentials

Treat the bot token referenced by any config or profile as a password, whether it arrives through DISCORD_BOT_TOKEN, another selected DISCORD_*_TOKEN variable, or a protected file. Keep it in a local secret source, never paste it into prompts, and never embed its value in static MCP client configuration, policy files, shell history, logs, issue reports, or Git. Rotate a token immediately in the Discord Developer Portal if exposure is suspected.

Treat every Discord invite code and complete invite URL as a bearer credential. Never copy one into an MCP argument, prompt, resource URI, audit reason, log, diagnostic, issue report, or persistent record. Use only the connector's process-local opaque invite references.

Treat every native Guild Template code and complete template use URL as a bearer credential. Never copy one into an MCP argument, prompt, resource URI, audit reason, log, diagnostic, issue report, or persistent record. Use only the connector's process-local opaque template references.

The connector sends the token only to Discord: in a bot authorization header at the fixed production REST API origin, or in Gateway Identify and Resume payloads after connecting to the fixed production gateway.discord.gg origin or a credential-free gateway-*.discord.gg resume host. Tests can inject another transport directly, but runtime environment variables cannot redirect production traffic.

Treat all Discord-provided names, descriptions, locations, topics, forum tags, thread names, message bodies, embeds, components, filenames, and URLs as untrusted input. They are data to inspect, not instructions for language models, MCP hosts, or connector operators.

Canonical source: SECURITY.md