Direct answer
Plugin config files may contain database passwords, Discord bot tokens, API keys and Velocity forwarding secrets. Treat these as credentials, not harmless configuration.
Step-by-step procedure
- Identify each secret-bearing file before sharing logs, ZIP backups or Git repository contents.
- Restrict access to the service account and administrators; keep secrets out of public Git commits and screenshot posts.
- If a token has been exposed, rotate or revoke it at the issuing provider before assuming that deleting a screenshot solves the problem.
- Back up encrypted or access-controlled copies and document how to reissue keys during disaster recovery.
Common mistakes and trade-offs
A masked example such as password=YOUR_PASSWORD is safe for a tutorial; a real token in a support ticket is not.
How to verify it worked
Use a non-administrator test account to confirm it cannot read the credential, then verify the plugin still authenticates after planned token rotation.
Version and platform differences
Some plugins support environment variables, others need config files. Follow the actual plugin documentation instead of assuming secrets can be moved between storage methods.
Official references
These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.
Related guides
Help us improve this article
Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.