Security
Keep tokens and server credentials out of public reports.
Do not share secrets
Never include Discord bot tokens, RCON passwords, panel API keys, .env contents, private server addresses you want kept private, or other credentials in public GitHub issues, pull requests, or chat logs.
Redact screenshots and logs
Before sharing screenshots or log excerpts, remove tokens, passwords, IP addresses you do not intend to publish, and any channel or guild IDs you consider sensitive for your community.
Ordinary bugs
Use GitHub Issues for ordinary bugs with sanitized reproduction steps. Prefer disposable test credentials when demonstrating a problem.
Vulnerability reports
The CraftCord repository does not currently include a SECURITY.md file, and no private vulnerability reporting channel or security email is documented there. Until the project publishes a dedicated private reporting path, do not invent one — avoid posting exploit details publicly, and watch the repository for an official security policy when the project is released.
Related reading: Privacy and Getting started.