Learn about security
Leaked keys, DDoS attacks and weak settings take projects down. Learn how to protect what you publish.
Featured
- ConceptsWhat is a brute force attack and how to defend against itA brute force attack tests passwords in bulk until one works. Learn the types (spraying, credential stuffing), how they work and the defenses, with code that runs.
- Problems and errorsMy app was hacked: what to do nowIf your app was hacked, contain access, rotate every secret and preserve the logs before cleaning up. See the right order, how to find the cause and how to recover.
- How-to guidesSecurity checklist for deploying a bot, site or APIA security checklist before you deploy a bot, site or API: secrets in environment variables, dependencies, HTTPS, headers, least privilege and logs.
Concepts3
- What is a brute force attack and how to defend against itA brute force attack tests passwords in bulk until one works. Learn the types (spraying, credential stuffing), how they work and the defenses, with code that runs.
- What is a DDoS attack?A DDoS attack floods a server with traffic from thousands of machines until it stops serving real users. Learn the three types, how it works and how to spot it.
- What is a web application firewall (WAF)?A WAF is a web application firewall: it reads HTTP requests and blocks attacks like SQL injection and XSS. Learn how it works, its limits and when to use one.
How-to guides4
- Security checklist for deploying a bot, site or APIA security checklist before you deploy a bot, site or API: secrets in environment variables, dependencies, HTTPS, headers, least privilege and logs.
- How to protect your app from DDoS attacksTo protect against DDoS, combine edge mitigation (CDN and WAF) with rate limiting, timeouts and caching in your app. Step-by-step guide with working code.
- How to keep secrets out of your codeKeep API keys, tokens and passwords out of Git: use environment variables, ignore .env files, scan commits for leaks and rotate any secret that escapes.
- SSH keys: how they work and how to create oneAn SSH key is a key pair (public and private) that proves who you are without a password. Learn to generate an Ed25519 key, use ssh-agent and test it on GitHub.
Problems and errors3
- My app was hacked: what to do nowIf your app was hacked, contain access, rotate every secret and preserve the logs before cleaning up. See the right order, how to find the cause and how to recover.
- API key exposed on GitHub: how to revoke and prevent itPushed an API key to GitHub? Revoke it first, then clean the history and rotate the value. Here are the steps and how to stop it from happening again.
- Leaked your bot token? What to do right nowIf your bot token leaked, reset it in the Discord Developer Portal (or with /token in BotFather) first. Learn the right order and how to check the damage.