Your bot token is a password to your bot. Anyone who has it can run your bot anywhere, read what it reads and post as it.
Store it in .env
Create a file named .env in the server root:
DISCORD_TOKEN=MTIz...your token...Read it in code. Node: require('dotenv').config(); const token = process.env.DISCORD_TOKEN; (add dotenv to package.json). Python: from dotenv import load_dotenv; load_dotenv(); token = os.getenv("DISCORD_TOKEN") with python-dotenv in requirements.
Never paste the token into index.js, into a GitHub repo or into a ticket. If you share code with us, remove the token first.
If it leaks
Go to the Discord Developer Portal → your application → Bot → Reset Token. The old token stops working instantly. Put the new one in .env, restart.
Subusers and the panel
Anyone with Files permission on the server can read .env. Give co-developers subuser access only if you trust them with the token, or give them console-only rights.