How to Store Bot Environment Variables Securely

One of the most catastrophic security mistakes in software development is hardcoding secret API keys, bot tokens, or database passwords directly inside application source code.

If source code containing hardcoded tokens is accidentally pushed to a public GitHub repository, automated scraping bots will detect and hijack your credentials within seconds.

In this guide, we explore how to isolate and store bot environment variables securely on your RivinCloud VPS.

1. Why Hardcoding Secrets is Dangerous

When you write code like this:

// ❌ DANGEROUS: DO NOT HARDCODE TOKENS IN SOURCE CODE
const TOKEN = "MTI0NTY3ODkwMTIzNDU2Nzg5MA.X_example_token_hash";

You introduce severe security risks:

• Git Commit Leakage: Secrets remain visible in your repository commit history forever even if deleted later.
• Collaborator Access: Team members given access to inspect frontend code gain full admin control over database keys and bot tokens.
• Environment Rigidity: You cannot switch between staging and production credentials easily.

2. Solution 1: Using .env Files with dotenv

Store secrets in a plain text .env file located in your project root folder:

# .env file
DISCORD_TOKEN=your_private_bot_token_here
DB_PASS=SuperSecretPassword123!
PORT=3000

In Node.js:

require('dotenv').config();

const token = process.env.DISCORD_TOKEN;
const dbPass = process.env.DB_PASS;

In Python:

import os
from dotenv import load_dotenv

load_dotenv()

token = os.getenv('DISCORD_TOKEN')

Crucial Security Step: Add .env to .gitignore

Create a .gitignore file in your repository:

.env
node_modules/
__pycache__/
*.log

3. Solution 2: Restricting .env File Permissions on Linux

On your RivinCloud VPS, ensure that other non-root users on the system cannot read your .env file:

# Set file permissions so only the owner can read/write
chmod 600 .env

4. Solution 3: Systemd EnvironmentFile (Best for System Services)

If running your bot under systemd, you can pass environment variables securely without embedding them in the service unit file itself:

1. Create a secrets file in /etc/default/:

   sudo nano /etc/default/mybot
   

   Add your keys:

   DISCORD_TOKEN=your_secret_token
   DB_HOST=127.0.0.1
   

   Set permissions:

   sudo chmod 600 /etc/default/mybot
   

2. Reference it in /etc/systemd/system/mybot.service:

   [Service]
   EnvironmentFile=/etc/default/mybot
   ExecStart=/usr/bin/node /home/ubuntu/mybot/index.js
   

Command of the Day: printenv

The printenv utility prints all environment variables currently exported in your active shell environment.

Syntax

printenv [variable_name]

Practical Examples

# 1. Print all environment variables
printenv

# 2. Check a specific environment variable
printenv PATH

# 3. Filter variables with grep
printenv | grep -i "node"

Explanation

printenv allows system administrators to verify if system-wide environment variables (such as PATH or NODE_ENV) are properly set in the current execution context.

Common Mistakes

• Committing .env.example containing real keys: Developers often create a template file named .env.example for collaborators, but accidentally paste real production tokens into it. .env.example should contain only dummy placeholder strings (DISCORD_TOKEN=your_token_here).
• Printing environment variables in crash logs: Be careful not to log process.env or os.environ to public log aggregators during error debugging.

Troubleshooting

• process.env.VARIABLE returns undefined:
  1. Ensure require('dotenv').config() is placed at the very top of your main entry file before accessing process.env.
  2. Verify that the .env file is in the exact root folder from which the process is launched.

Best Practices

• Revoke and regenerate bot tokens immediately if you suspect a leak.
• Use secret manager services (like HashiCorp Vault or AWS Secrets Manager) for multi-server enterprise infrastructure.

Frequently Asked Questions

What should I do if I accidentally pushed my bot token to GitHub?

Immediately go to the Discord Developer Portal (or platform developer dashboard), click Reset Token, update your server's .env file with the new token, and remove the leaked commit from GitHub.

Conclusion

Isolating secrets using .env files and strict Linux permissions (chmod 600) protects your server infrastructure from credential leaks. Secure your bot tokens on RivinCloud VPS today!