Skip to content

Security: ashish200729/vxbot

Security

docs/security.md

Security

This document covers secret management and known security considerations before open-sourcing VXBot.

Secret management

All secrets live in .env at the repository root (gitignored). The bot loads them via python-dotenv in src/config.py.

cp .env.example .env
# edit .env with your values

Never commit:

  • .env
  • src/config.py
  • src/config.runtime.json
  • Database backups (*.sql.gz)
  • Log files with user data

Rotate these before going public

If this repository was ever private or shared, rotate every credential that may have been committed to Git history:

Secret Where it was exposed
Discord bot token src/config.py (git history)
PostgreSQL password src/config.py, backup.sql.gz
Groq API key ai_support.py (git history)
Gemini API key idp/__init__.py
Spotify client secrets music.py, Bot.py
Discord webhook URL PUBLIC_LOG in config
FASTAPI_KEY config

After rotating, purge Git history with git-filter-repo or BFG, then force-push.

Payment callbacks

PayU success/failure webhooks are verified with PayU's reverse hash (verify_payu_response_hash in src/server/app/payment.py). Do not rely on the Origin header alone — it is spoofable.

The /getpremium route requires the X-API-Key header when FASTAPI_KEY is set in .env.

Run the payment server behind HTTPS (reverse proxy) in production.

Additional risks to be aware of

Risk Location Notes
literal_eval on stored data models/esports/scrims.py, cogs/utility/__init__.py Prefer json.loads for serialized embeds
LLM prompt injection cogs/ai-chatbot/ai_support.py User messages are sent to Groq
SSRF via image URLs cogs/quomisc/custombot_views.py Validate URLs before fetching

Pre-publish checklist

  • Rotate all API keys, tokens, and database passwords
  • Purge secrets from Git history
  • Confirm .env and src/config.py are not tracked (git ls-files .env src/config.py should be empty)
  • Run a secret scanner (gitleaks, trufflehog) on the repo
  • Set FASTAPI_KEY in production and pass it as X-API-Key from trusted callers

There aren't any published security advisories