[Security] Publicly exposed Discord webhook URL in this repository

[sudoanonymouscoder]

Hello!

While researching publicly leaked Discord webhook URLs, I found what appears to be an exposed webhook URL in this repository. I'm filing this issue rather than using the webhook itself so nothing is posted into your server.

Where: {file}
Link: {link}

What this means

A Discord webhook URL is a bearer credential - anyone who has the full URL can post messages, embeds, or files to your channel with no login required. The long token at the end of the URL is effectively a password:

https://discord.com/api/webhooks/<id>/<token>

These get found within minutes-to-hours of being pushed, because GitHub code search (and tools like gitleaks/trufflehog) can match the literal pattern discord.com/api/webhooks/ across all public repositories.

How to fix it (takes ~10 seconds)

1. Open your server: Server Settings -> Integrations -> Webhooks
2. Delete the affected webhook (or regenerate its URL)
3. Load the replacement from an environment variable or an untracked config file
4. Optional but recommended:
   • Add .env and config files with secrets to .gitignore
   • Purge the secret from git history (e.g. with BFG Repo-Cleaner)
   • Consider making the repo private if it was never meant to be public

If you believe this was intentional sample data, feel free to close this issue.

Thanks, and stay safe!