tab-bot/docs/security/tokens.md

Why tokens aren’t in URLs

A runner URL like /run/bot_abc is safe to bookmark, screenshot, and paste. A URL like /run/bot_abc?token=Bot%20MTk… is a leak:

• Browser history
• Crash reports
• Referrer headers
• Shoulder surfing
• pm2 logs / reverse-proxy access logs if you self-host poorly

TabBot therefore:

1. Opens /run/:botId with no search string
2. Sends the token and named-secret bag over postMessage / BroadcastChannel after a nonce handshake
3. Holds a copy in the runner’s sessionStorage until the tab dies

Named secrets (llm/apiKey, translation/apiKey, anything you add in Settings) follow the same rule: not in URLs, share codes, git, or Discord. See Named secrets.

If you ever see token= on a TabBot URL, stop, rotate the Discord token, and file a bug. Do not send the leaked token to HoneyPeer.

Invite URLs use client_id and permissions only. That is not a bot token.