[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-branding":3,"content-de-bot-token-security":8,"public-ads-config":1087},{"siteName":4,"primaryColor":5,"accentColor":6,"faviconUrl":7,"logoUrl":7},"KiroCloud","#ffffff","#888888","",{"id":9,"title":10,"author":11,"body":12,"category":11,"description":23,"extension":1073,"lastUpdated":11,"meta":1074,"navigation":164,"order":1075,"path":1076,"readTime":11,"seo":1077,"stem":1085,"__hash__":1086},"docs\u002Fdocs\u002Fde\u002Fbot-token-security.md","[object Object]",null,{"type":13,"value":14,"toc":1065},"minimark",[15,20,24,32,35,40,43,56,61,68,70,74,81,101,110,112,116,123,1004,1019,1021,1025,1058,1061],[16,17,19],"h1",{"id":18},"discord-bot-token-security-envelope-encryption-aes-256-gcm-secret-management","Discord Bot Token Security: Envelope Encryption (AES-256-GCM) & Secret Management",[21,22,23],"p",{},"Ein kompromittierter Discord-Bot-Token verleiht Angreifern uneingeschränkten Zugriff auf die Bot-Identität, private Server, Chatverläufe und Administrator-Befehle. Wenn ein Bot auf Tausenden von Servern aktiv ist, kann ein Token-Leak zur Zerstörung von Communities (Raid-Attacken) und zum dauerhaften Bann der Applikation durch Discord führen.",[21,25,26,27,31],{},"In diesem Leitfaden stellen wir die kryptografische Sicherheitsarchitektur vor, wie sie auf KiroCloud zur Absicherung sensibler Anmeldedaten im Ruhezustand (Data at Rest) mit ",[28,29,30],"strong",{},"AES-256-GCM Envelope Encryption"," implementiert ist.",[33,34],"hr",{},[36,37,39],"h2",{"id":38},"_1-warum-plaintext-speicherung-in-datenbanken-inakzeptabel-ist","1. Warum Plaintext-Speicherung in Datenbanken inakzeptabel ist",[21,41,42],{},"Das Speichern von Bot-Tokens in Klartext in einer Datenbank (wie PostgreSQL oder MySQL) stellt ein extremes Sicherheitsrisiko dar:",[44,45,46,50,53],"ul",{},[47,48,49],"li",{},"Datenbank-Dumps und Backups enthalten unverschlüsselte Tokens.",[47,51,52],{},"SQL-Injection-Schwachstellen können direkt alle Tokens im System kompromittieren.",[47,54,55],{},"Entwickler oder Administratoren mit Lesezugriff auf die Datenbank können fremde Bots kapern.",[57,58,60],"h3",{"id":59},"warum-einfaches-hashing-wie-bcrypt-oder-argon2-nicht-funktioniert","Warum einfaches Hashing (wie bcrypt oder Argon2) nicht funktioniert:",[21,62,63,64,67],{},"Passwörter werden gehasht, weil man sie nach dem Login nie wieder im Klartext benötigt. Ein Bot-Token muss jedoch von der Host-Plattform im Klartext verwendet werden, um sich am Discord Gateway anzumelden. Daher ist eine ",[28,65,66],{},"starke, authentifizierte symmetrische Verschlüsselung"," zwingend erforderlich.",[33,69],{},[36,71,73],{"id":72},"_2-der-goldstandard-authenticated-encryption-mit-aes-256-gcm","2. Der Goldstandard: Authenticated Encryption mit AES-256-GCM",[21,75,76,77,80],{},"Wir verwenden den Algorithmus ",[28,78,79],{},"AES-256-GCM"," (Galois\u002FCounter Mode). GCM bietet zwei entscheidende Vorteile:",[82,83,84,90],"ol",{},[47,85,86,89],{},[28,87,88],{},"Vertraulichkeit:"," Niemand ohne den Master-Schlüssel kann den Token entschlüsseln.",[47,91,92,95,96,100],{},[28,93,94],{},"Integrität & Authentizität:"," Durch einen 128-Bit Authentifizierungs-Tag (",[97,98,99],"code",{},"authTag",") wird jeder Manipulationsversuch an der verschlüsselten Zeichenkette sofort erkannt und führt zum Abbruch der Entschlüsselung.",[102,103,108],"pre",{"className":104,"code":106,"language":107},[105],"language-text","                  ┌───────────────────────────────┐\n                  │    Discord Bot Token (Plain)  │\n                  └───────────────┬───────────────┘\n                                  │\n                  ┌───────────────▼───────────────┐\n                  │     AES-256-GCM Verschlüssler  │ ◄─── Master Key (256-bit)\n                  └───────┬───────────────┬───────┘ ◄─── Random IV (96-bit)\n                          │               │\n            ┌─────────────▼─────┐   ┌─────▼─────────────┐\n            │ Verschlüsselter   │   │ Authentication    │\n            │ Ciphertext        │   │ Tag (128-bit)     │\n            └─────────────┬─────┘   └─────┬─────────────┘\n                          │               │\n                          ▼               ▼\n                  ┌───────────────────────────────┐\n                  │     PostgreSQL Datensatz      │\n                  │ (token_enc, token_iv, token_tag)\n                  └───────────────────────────────┘\n","text",[97,109,106],{"__ignoreMap":7},[33,111],{},[36,113,115],{"id":114},"_3-vollständige-nodejs-krypto-implementierung","3. Vollständige Node.js Krypto-Implementierung",[21,117,118,119,122],{},"Nutze das native ",[97,120,121],{},"node:crypto","-Modul für kryptografisch sichere Ver- und Entschlüsselung:",[102,124,128],{"className":125,"code":126,"language":127,"meta":7,"style":7},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import crypto from 'node:crypto';\n\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 12; \u002F\u002F 96 Bit für GCM Standard\n\nexport interface EncryptedSecret {\n  ciphertext: string;\n  iv: string;\n  authTag: string;\n}\n\n\u002F**\n * Verschlüsselt ein Geheimnis mit AES-256-GCM\n *\u002F\nexport function encryptSecret(plaintext: string, masterKeyHex: string): EncryptedSecret {\n  const key = Buffer.from(masterKeyHex, 'hex');\n  if (key.length !== 32) {\n    throw new Error('Master key must be 32 bytes (256 bits).');\n  }\n\n  \u002F\u002F WICHTIG: Jeder Vorgang MUSS einen kryptografisch zufälligen IV verwenden!\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);\n\n  let ciphertext = cipher.update(plaintext, 'utf8', 'hex');\n  ciphertext += cipher.final('hex');\n\n  const authTag = cipher.getAuthTag().toString('hex');\n\n  return {\n    ciphertext,\n    iv: iv.toString('hex'),\n    authTag,\n  };\n}\n\n\u002F**\n * Entschlüsselt ein Geheimnis und verifiziert dessen Integrität\n *\u002F\nexport function decryptSecret(encrypted: EncryptedSecret, masterKeyHex: string): string {\n  const key = Buffer.from(masterKeyHex, 'hex');\n  const iv = Buffer.from(encrypted.iv, 'hex');\n  const authTag = Buffer.from(encrypted.authTag, 'hex');\n\n  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);\n  decipher.setAuthTag(authTag);\n\n  let plaintext = decipher.update(encrypted.ciphertext, 'hex', 'utf8');\n  plaintext += decipher.final('utf8'); \u002F\u002F Wirft Fehler bei manipuliertem Ciphertext!\n\n  return plaintext;\n}\n","typescript",[97,129,130,159,166,188,209,214,230,245,257,269,275,280,286,292,298,338,377,406,431,437,442,448,475,509,514,557,584,589,626,631,639,648,674,682,688,693,698,703,709,714,747,778,814,849,854,887,906,911,956,985,990,999],{"__ignoreMap":7},[131,132,135,139,143,146,150,153,156],"span",{"class":133,"line":134},"line",1,[131,136,138],{"class":137},"s7zQu","import",[131,140,142],{"class":141},"sTEyZ"," crypto ",[131,144,145],{"class":137},"from",[131,147,149],{"class":148},"sMK4o"," '",[131,151,121],{"class":152},"sfazB",[131,154,155],{"class":148},"'",[131,157,158],{"class":148},";\n",[131,160,162],{"class":133,"line":161},2,[131,163,165],{"emptyLinePlaceholder":164},true,"\n",[131,167,169,173,176,179,181,184,186],{"class":133,"line":168},3,[131,170,172],{"class":171},"spNyl","const",[131,174,175],{"class":141}," ALGORITHM ",[131,177,178],{"class":148},"=",[131,180,149],{"class":148},[131,182,183],{"class":152},"aes-256-gcm",[131,185,155],{"class":148},[131,187,158],{"class":148},[131,189,191,193,196,198,202,205],{"class":133,"line":190},4,[131,192,172],{"class":171},[131,194,195],{"class":141}," IV_LENGTH ",[131,197,178],{"class":148},[131,199,201],{"class":200},"sbssI"," 12",[131,203,204],{"class":148},";",[131,206,208],{"class":207},"sHwdD"," \u002F\u002F 96 Bit für GCM Standard\n",[131,210,212],{"class":133,"line":211},5,[131,213,165],{"emptyLinePlaceholder":164},[131,215,217,220,223,227],{"class":133,"line":216},6,[131,218,219],{"class":137},"export",[131,221,222],{"class":171}," interface",[131,224,226],{"class":225},"sBMFI"," EncryptedSecret",[131,228,229],{"class":148}," {\n",[131,231,233,237,240,243],{"class":133,"line":232},7,[131,234,236],{"class":235},"swJcz","  ciphertext",[131,238,239],{"class":148},":",[131,241,242],{"class":225}," string",[131,244,158],{"class":148},[131,246,248,251,253,255],{"class":133,"line":247},8,[131,249,250],{"class":235},"  iv",[131,252,239],{"class":148},[131,254,242],{"class":225},[131,256,158],{"class":148},[131,258,260,263,265,267],{"class":133,"line":259},9,[131,261,262],{"class":235},"  authTag",[131,264,239],{"class":148},[131,266,242],{"class":225},[131,268,158],{"class":148},[131,270,272],{"class":133,"line":271},10,[131,273,274],{"class":148},"}\n",[131,276,278],{"class":133,"line":277},11,[131,279,165],{"emptyLinePlaceholder":164},[131,281,283],{"class":133,"line":282},12,[131,284,285],{"class":207},"\u002F**\n",[131,287,289],{"class":133,"line":288},13,[131,290,291],{"class":207}," * Verschlüsselt ein Geheimnis mit AES-256-GCM\n",[131,293,295],{"class":133,"line":294},14,[131,296,297],{"class":207}," *\u002F\n",[131,299,301,303,306,310,313,317,319,321,324,327,329,331,334,336],{"class":133,"line":300},15,[131,302,219],{"class":137},[131,304,305],{"class":171}," function",[131,307,309],{"class":308},"s2Zo4"," encryptSecret",[131,311,312],{"class":148},"(",[131,314,316],{"class":315},"sHdIc","plaintext",[131,318,239],{"class":148},[131,320,242],{"class":225},[131,322,323],{"class":148},",",[131,325,326],{"class":315}," masterKeyHex",[131,328,239],{"class":148},[131,330,242],{"class":225},[131,332,333],{"class":148},"):",[131,335,226],{"class":225},[131,337,229],{"class":148},[131,339,341,344,347,350,353,356,358,360,363,365,367,370,372,375],{"class":133,"line":340},16,[131,342,343],{"class":171},"  const",[131,345,346],{"class":141}," key",[131,348,349],{"class":148}," =",[131,351,352],{"class":141}," Buffer",[131,354,355],{"class":148},".",[131,357,145],{"class":308},[131,359,312],{"class":235},[131,361,362],{"class":141},"masterKeyHex",[131,364,323],{"class":148},[131,366,149],{"class":148},[131,368,369],{"class":152},"hex",[131,371,155],{"class":148},[131,373,374],{"class":235},")",[131,376,158],{"class":148},[131,378,380,383,386,389,391,394,397,400,403],{"class":133,"line":379},17,[131,381,382],{"class":137},"  if",[131,384,385],{"class":235}," (",[131,387,388],{"class":141},"key",[131,390,355],{"class":148},[131,392,393],{"class":141},"length",[131,395,396],{"class":148}," !==",[131,398,399],{"class":200}," 32",[131,401,402],{"class":235},") ",[131,404,405],{"class":148},"{\n",[131,407,409,412,415,418,420,422,425,427,429],{"class":133,"line":408},18,[131,410,411],{"class":137},"    throw",[131,413,414],{"class":148}," new",[131,416,417],{"class":308}," Error",[131,419,312],{"class":235},[131,421,155],{"class":148},[131,423,424],{"class":152},"Master key must be 32 bytes (256 bits).",[131,426,155],{"class":148},[131,428,374],{"class":235},[131,430,158],{"class":148},[131,432,434],{"class":133,"line":433},19,[131,435,436],{"class":148},"  }\n",[131,438,440],{"class":133,"line":439},20,[131,441,165],{"emptyLinePlaceholder":164},[131,443,445],{"class":133,"line":444},21,[131,446,447],{"class":207},"  \u002F\u002F WICHTIG: Jeder Vorgang MUSS einen kryptografisch zufälligen IV verwenden!\n",[131,449,451,453,456,458,461,463,466,468,471,473],{"class":133,"line":450},22,[131,452,343],{"class":171},[131,454,455],{"class":141}," iv",[131,457,349],{"class":148},[131,459,460],{"class":141}," crypto",[131,462,355],{"class":148},[131,464,465],{"class":308},"randomBytes",[131,467,312],{"class":235},[131,469,470],{"class":141},"IV_LENGTH",[131,472,374],{"class":235},[131,474,158],{"class":148},[131,476,478,480,483,485,487,489,492,494,497,499,501,503,505,507],{"class":133,"line":477},23,[131,479,343],{"class":171},[131,481,482],{"class":141}," cipher",[131,484,349],{"class":148},[131,486,460],{"class":141},[131,488,355],{"class":148},[131,490,491],{"class":308},"createCipheriv",[131,493,312],{"class":235},[131,495,496],{"class":141},"ALGORITHM",[131,498,323],{"class":148},[131,500,346],{"class":141},[131,502,323],{"class":148},[131,504,455],{"class":141},[131,506,374],{"class":235},[131,508,158],{"class":148},[131,510,512],{"class":133,"line":511},24,[131,513,165],{"emptyLinePlaceholder":164},[131,515,517,520,523,525,527,529,532,534,536,538,540,543,545,547,549,551,553,555],{"class":133,"line":516},25,[131,518,519],{"class":171},"  let",[131,521,522],{"class":141}," ciphertext",[131,524,349],{"class":148},[131,526,482],{"class":141},[131,528,355],{"class":148},[131,530,531],{"class":308},"update",[131,533,312],{"class":235},[131,535,316],{"class":141},[131,537,323],{"class":148},[131,539,149],{"class":148},[131,541,542],{"class":152},"utf8",[131,544,155],{"class":148},[131,546,323],{"class":148},[131,548,149],{"class":148},[131,550,369],{"class":152},[131,552,155],{"class":148},[131,554,374],{"class":235},[131,556,158],{"class":148},[131,558,560,562,565,567,569,572,574,576,578,580,582],{"class":133,"line":559},26,[131,561,236],{"class":141},[131,563,564],{"class":148}," +=",[131,566,482],{"class":141},[131,568,355],{"class":148},[131,570,571],{"class":308},"final",[131,573,312],{"class":235},[131,575,155],{"class":148},[131,577,369],{"class":152},[131,579,155],{"class":148},[131,581,374],{"class":235},[131,583,158],{"class":148},[131,585,587],{"class":133,"line":586},27,[131,588,165],{"emptyLinePlaceholder":164},[131,590,592,594,597,599,601,603,606,609,611,614,616,618,620,622,624],{"class":133,"line":591},28,[131,593,343],{"class":171},[131,595,596],{"class":141}," authTag",[131,598,349],{"class":148},[131,600,482],{"class":141},[131,602,355],{"class":148},[131,604,605],{"class":308},"getAuthTag",[131,607,608],{"class":235},"()",[131,610,355],{"class":148},[131,612,613],{"class":308},"toString",[131,615,312],{"class":235},[131,617,155],{"class":148},[131,619,369],{"class":152},[131,621,155],{"class":148},[131,623,374],{"class":235},[131,625,158],{"class":148},[131,627,629],{"class":133,"line":628},29,[131,630,165],{"emptyLinePlaceholder":164},[131,632,634,637],{"class":133,"line":633},30,[131,635,636],{"class":137},"  return",[131,638,229],{"class":148},[131,640,642,645],{"class":133,"line":641},31,[131,643,644],{"class":141},"    ciphertext",[131,646,647],{"class":148},",\n",[131,649,651,654,656,658,660,662,664,666,668,670,672],{"class":133,"line":650},32,[131,652,653],{"class":235},"    iv",[131,655,239],{"class":148},[131,657,455],{"class":141},[131,659,355],{"class":148},[131,661,613],{"class":308},[131,663,312],{"class":235},[131,665,155],{"class":148},[131,667,369],{"class":152},[131,669,155],{"class":148},[131,671,374],{"class":235},[131,673,647],{"class":148},[131,675,677,680],{"class":133,"line":676},33,[131,678,679],{"class":141},"    authTag",[131,681,647],{"class":148},[131,683,685],{"class":133,"line":684},34,[131,686,687],{"class":148},"  };\n",[131,689,691],{"class":133,"line":690},35,[131,692,274],{"class":148},[131,694,696],{"class":133,"line":695},36,[131,697,165],{"emptyLinePlaceholder":164},[131,699,701],{"class":133,"line":700},37,[131,702,285],{"class":207},[131,704,706],{"class":133,"line":705},38,[131,707,708],{"class":207}," * Entschlüsselt ein Geheimnis und verifiziert dessen Integrität\n",[131,710,712],{"class":133,"line":711},39,[131,713,297],{"class":207},[131,715,717,719,721,724,726,729,731,733,735,737,739,741,743,745],{"class":133,"line":716},40,[131,718,219],{"class":137},[131,720,305],{"class":171},[131,722,723],{"class":308}," decryptSecret",[131,725,312],{"class":148},[131,727,728],{"class":315},"encrypted",[131,730,239],{"class":148},[131,732,226],{"class":225},[131,734,323],{"class":148},[131,736,326],{"class":315},[131,738,239],{"class":148},[131,740,242],{"class":225},[131,742,333],{"class":148},[131,744,242],{"class":225},[131,746,229],{"class":148},[131,748,750,752,754,756,758,760,762,764,766,768,770,772,774,776],{"class":133,"line":749},41,[131,751,343],{"class":171},[131,753,346],{"class":141},[131,755,349],{"class":148},[131,757,352],{"class":141},[131,759,355],{"class":148},[131,761,145],{"class":308},[131,763,312],{"class":235},[131,765,362],{"class":141},[131,767,323],{"class":148},[131,769,149],{"class":148},[131,771,369],{"class":152},[131,773,155],{"class":148},[131,775,374],{"class":235},[131,777,158],{"class":148},[131,779,781,783,785,787,789,791,793,795,797,799,802,804,806,808,810,812],{"class":133,"line":780},42,[131,782,343],{"class":171},[131,784,455],{"class":141},[131,786,349],{"class":148},[131,788,352],{"class":141},[131,790,355],{"class":148},[131,792,145],{"class":308},[131,794,312],{"class":235},[131,796,728],{"class":141},[131,798,355],{"class":148},[131,800,801],{"class":141},"iv",[131,803,323],{"class":148},[131,805,149],{"class":148},[131,807,369],{"class":152},[131,809,155],{"class":148},[131,811,374],{"class":235},[131,813,158],{"class":148},[131,815,817,819,821,823,825,827,829,831,833,835,837,839,841,843,845,847],{"class":133,"line":816},43,[131,818,343],{"class":171},[131,820,596],{"class":141},[131,822,349],{"class":148},[131,824,352],{"class":141},[131,826,355],{"class":148},[131,828,145],{"class":308},[131,830,312],{"class":235},[131,832,728],{"class":141},[131,834,355],{"class":148},[131,836,99],{"class":141},[131,838,323],{"class":148},[131,840,149],{"class":148},[131,842,369],{"class":152},[131,844,155],{"class":148},[131,846,374],{"class":235},[131,848,158],{"class":148},[131,850,852],{"class":133,"line":851},44,[131,853,165],{"emptyLinePlaceholder":164},[131,855,857,859,862,864,866,868,871,873,875,877,879,881,883,885],{"class":133,"line":856},45,[131,858,343],{"class":171},[131,860,861],{"class":141}," decipher",[131,863,349],{"class":148},[131,865,460],{"class":141},[131,867,355],{"class":148},[131,869,870],{"class":308},"createDecipheriv",[131,872,312],{"class":235},[131,874,496],{"class":141},[131,876,323],{"class":148},[131,878,346],{"class":141},[131,880,323],{"class":148},[131,882,455],{"class":141},[131,884,374],{"class":235},[131,886,158],{"class":148},[131,888,890,893,895,898,900,902,904],{"class":133,"line":889},46,[131,891,892],{"class":141},"  decipher",[131,894,355],{"class":148},[131,896,897],{"class":308},"setAuthTag",[131,899,312],{"class":235},[131,901,99],{"class":141},[131,903,374],{"class":235},[131,905,158],{"class":148},[131,907,909],{"class":133,"line":908},47,[131,910,165],{"emptyLinePlaceholder":164},[131,912,914,916,919,921,923,925,927,929,931,933,936,938,940,942,944,946,948,950,952,954],{"class":133,"line":913},48,[131,915,519],{"class":171},[131,917,918],{"class":141}," plaintext",[131,920,349],{"class":148},[131,922,861],{"class":141},[131,924,355],{"class":148},[131,926,531],{"class":308},[131,928,312],{"class":235},[131,930,728],{"class":141},[131,932,355],{"class":148},[131,934,935],{"class":141},"ciphertext",[131,937,323],{"class":148},[131,939,149],{"class":148},[131,941,369],{"class":152},[131,943,155],{"class":148},[131,945,323],{"class":148},[131,947,149],{"class":148},[131,949,542],{"class":152},[131,951,155],{"class":148},[131,953,374],{"class":235},[131,955,158],{"class":148},[131,957,959,962,964,966,968,970,972,974,976,978,980,982],{"class":133,"line":958},49,[131,960,961],{"class":141},"  plaintext",[131,963,564],{"class":148},[131,965,861],{"class":141},[131,967,355],{"class":148},[131,969,571],{"class":308},[131,971,312],{"class":235},[131,973,155],{"class":148},[131,975,542],{"class":152},[131,977,155],{"class":148},[131,979,374],{"class":235},[131,981,204],{"class":148},[131,983,984],{"class":207}," \u002F\u002F Wirft Fehler bei manipuliertem Ciphertext!\n",[131,986,988],{"class":133,"line":987},50,[131,989,165],{"emptyLinePlaceholder":164},[131,991,993,995,997],{"class":133,"line":992},51,[131,994,636],{"class":137},[131,996,918],{"class":141},[131,998,158],{"class":148},[131,1000,1002],{"class":133,"line":1001},52,[131,1003,274],{"class":148},[1005,1006,1007],"blockquote",{},[21,1008,1009,1012,1015,1016,355],{},[131,1010,1011],{},"!CAUTION",[28,1013,1014],{},"Niemals denselben IV wiederverwenden:"," In GCM führt die Wiederverwendung desselben Initialisierungsvektors mit demselben Schlüssel zum vollständigen Verlust der Authentizität und kann die Wiederherstellung des Klartexts ermöglichen. Erzeuge den IV ausnahmslos mit ",[97,1017,1018],{},"crypto.randomBytes(12)",[33,1020],{},[36,1022,1024],{"id":1023},"_4-secret-management-key-rotation","4. Secret Management & Key Rotation",[82,1026,1027,1041],{},[47,1028,1029,1032,1033,1036,1037,1040],{},[28,1030,1031],{},"Master-Key niemals im Git-Repository speichern:"," Der AES-Schlüssel gehört ausschließlich in strikt geschützte Umgebungsvariablen (",[97,1034,1035],{},".env"," oder Vault-Systeme) mit restriktiven Dateirechten (",[97,1038,1039],{},"chmod 600",").",[47,1042,1043,1046,1047],{},[28,1044,1045],{},"Schlüssel-Rotation (Re-Encryption):"," Wenn der Master-Schlüssel erneuert werden muss, führt ein Hintergrunddienst eine sequenzielle Re-Encryption durch:\n",[44,1048,1049,1052,1055],{},[47,1050,1051],{},"Entschlüsseln mit altem Schlüssel",[47,1053,1054],{},"Verschlüsseln mit neuem Schlüssel",[47,1056,1057],{},"Transaktionales Update in der Datenbank",[21,1059,1060],{},"Auf KiroCloud geschieht diese Verschlüsselung vollautomatisch beim Eintragen von Discord-Tokens, wodurch selbst im Falle eines physischen Datenbankdiebstahls kein einziger Bot-Token kompromittiert werden kann.",[1062,1063,1064],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":7,"searchDepth":161,"depth":161,"links":1066},[1067,1070,1071,1072],{"id":38,"depth":161,"text":39,"children":1068},[1069],{"id":59,"depth":168,"text":60},{"id":72,"depth":161,"text":73},{"id":114,"depth":161,"text":115},{"id":1023,"depth":161,"text":1024},"md",{},0,"\u002Fdocs\u002Fde\u002Fbot-token-security",{"title":1078,"description":23},{"Discord Bot Token Security":1079,"description":1080,"category":1081,"order":134,"author":1082,"readTime":1083,"lastUpdated":1084},"Envelope Encryption (AES-256-GCM) & Secret Management","Sicherheitsarchitektur zum Schutz sensibler Bot-Tokens. Envelope Encryption mit AES-256-GCM, Schlüsselrotation und sichere Datenbank-Speicherung.","security","Luca Lichtenwald","13 min","2026-10-09","docs\u002Fde\u002Fbot-token-security","LixuaSl5UldVn9lmiX5azvcI3D46EORfgTrysL5ud20",{"enabled":164,"clientPubId":1088,"docsSlotId":7,"newsSlotId":7,"guidesSlotId":7,"dashboardSlotId":7,"docsEnabled":164,"newsEnabled":164,"guidesEnabled":164,"dashboardEnabled":164},"ca-pub-9454065621077312"]