pernydev / endi-bot Goto Github PK

Hi! I accidentally leaked the .env file of the bot on 17.11.2023 at 8:17 AM. This happened due to being in a rush and extremely tired. All of the passwords, keys and tokens have been revoked/changed (OpenAI and Discord automatically, Redis manually).

This is how it happened:

I am in quite the rush because I have to be in school in about 15 minutes. I want to program the bot at school so I decide to push the code.

Then I was looking at the unstaged changes as if they were the staged ones and realized that .env was there. I did not have time to modify the .gitignore so I just removed .env from the list.. Meaning that now .env was the only file staged. I don't look at that and just commit and push due to my tiredness.

I notice that "hey, how come it only shows 1 addition?" and then click on the commit and see what's inside.. I think "oh fuck, here we go." and instantly at that moment I get a message telling me my bot token has been leaked.

Then I rushed to OpenAI to remove the token and when clicking on the bin icon on my key it gives a 404 error, phew also deleted automatically!

Then I head over to our Redis management panel and kill the instance. I don't want our Redis instance crypto mining 😆. There is truly nothing too secretive in our instance however. It was just a key value database of DIscord IDs and their Minecraft names.

Conclusion

Sorry for that! I was tired and in a rush but everything turned out fine. What I did learn was that my go to before GitKraken had a delay of 7 minutes. That is completely unacceptable for something like Discord or OpenAI token. The Discord Server could have been completely fucked up during this time.