1. Secret scanner and redactor
2. Secret generator
3. JWT decoder
If a token leaked
- Revoke first, investigate second. Telegram: BotFather /revoke. Discord: Developer Portal, Bot, Reset Token. Slack: rotate in the app settings. GitHub: delete the token.
- Deploy the new value from your secret store, not from a file in the repository.
- Rewrite Git history only after rotating: forks and caches keep the old commit.
- Review what the token could do during the exposure window (messages sent, webhooks changed, servers joined).
Pattern matching finds known formats only. Pair it with Gitleaks or TruffleHog in CI and read the bot security guide.