• All user inputs are sanitized to prevent injection attacks
• Prompt injection patterns are detected and removed
• Control characters are filtered out
• Input length limits are enforced

• Per-user rate limiting (10 requests per minute)
• Sliding window implementation
• Automatic cleanup of old rate limit data

• Environment variables for sensitive data
• API key validation and placeholder detection
• Secure error handling that doesn't expose internal details
• Timeout protection for API calls

• Proper Discord ID validation
• Permission checking for message access
• Secure interaction handling

If you discover a security vulnerability, please report it by:

1. DO NOT create a public GitHub issue
2. Contact the maintainers privately
3. Provide detailed information about the vulnerability
4. Allow time for the issue to be addressed before public disclosure

• Never commit real API keys to the repository
• Use the provided .env.example as a template
• Ensure .env is in your .gitignore

• Rotate API keys regularly
• Use environment-specific keys (dev/staging/prod)
• Monitor API key usage for unusual activity

• Use HTTPS in production
• Implement proper logging and monitoring
• Keep dependencies updated
• Use process managers for production deployment

• Discord ID format validation
• User input sanitization
• Prompt injection prevention
• Length limits and truncation

• User-based rate limiting
• Configurable limits and windows
• Memory-efficient sliding window implementation

• Secure error messages that don't expose internals
• Comprehensive logging for security events
• Graceful degradation on errors

• Request timeouts
• Retry logic with exponential backoff
• Error categorization and handling
• Authentication validation

DISCORD_TOKEN=your_discord_bot_token_here
CLIENT_ID=your_discord_application_client_id_here
GEMINI_API_KEY=your_gemini_api_key_here
LOG_LEVEL=INFO  # Optional: DEBUG, INFO, WARN, ERROR

The bot implements various security measures:

• Input sanitization for all user content
• Rate limiting to prevent abuse
• Secure error handling
• API timeout protection

The bot logs security-relevant events including:

• Rate limit violations
• Input validation failures
• API authentication errors
• Unusual error patterns

Monitor these logs for potential security issues.