[Security] Publicly exposed Discord webhook URL in this repository

[sudoanonymouscoder]

Hello!

While researching publicly leaked Discord webhook URLs I found an exposed webhook in this repository. I'm filing this issue instead of using the webhook so nothing is posted into your server.

Exact location

• config.json - view on GitHub: line 2

  "honkWebhook" : "https://discord.com/api/webhooks/753069618062426263/***REDACTED***"...
  

What this means

A Discord webhook URL is a bearer credential - anyone with the full URL can post messages to your channel without logging in. The token at the end of the URL is effectively a password:

https://discord.com/api/webhooks/<id>/<token>

Automated scanners match the pattern discord.com/api/webhooks/ across all public repos within minutes-to-hours of a push.

How to fix it (~10 seconds)

1. Server Settings -> Integrations -> Webhooks -> delete or regenerate it
2. Load the new URL from an environment variable / untracked config file
3. Recommended: add secret files to .gitignore, purge history (BFG Repo-Cleaner), and consider making the repo private

If this was intentional sample data, feel free to close the issue.

Thanks, and stay safe!