Schokr account security basics

Most hosting account problems come from reused passwords, leaked tokens and team members with more access than they need. These habits keep your Schokr account and servers safe.

Use a strong, unique password#

• Use a password you do not use anywhere else. Reused passwords get leaked from other sites and tried on yours.
• Make it long. A passphrase of four or more random words is easier to remember and harder to guess than a short complex password.
• Use a password manager to generate and store it.
• Secure the email account you signed up with too, since it can be used to reset access.

Never share your login#

Give others access through teams instead. Each person gets their own account and a role with only the permissions they need. Sharing a login gives away everything, including billing and the ability to delete servers, and the activity log can no longer tell you who did what.

Protect tokens and secrets#

Discord bot tokens, API keys and database passwords are as sensitive as passwords.

• Never paste them in Discord, screenshots, public repositories or support threads.
• Store them in a .env file or Startup variables, not in code you share.
• Add .env to .gitignore if you use git:

.env
node_modules/
__pycache__/

• Regenerate a token immediately if it leaks. For Discord, reset it in the Discord Developer Portal, then update your server's .env or Startup variable and restart.

Use least privilege for team roles#

Give each member the minimum they need:

• Moderators usually only need the console.
• Only trusted people should get files, startup, backups, snapshots or settings.
• Keep billing and store with the owner.

See team roles and permissions.

Be careful with what you install#

Plugins, mods and packages run with full access to your server's files. Only install them from trusted sources such as official project pages, and avoid "leaked" or cracked premium plugins, which often contain backdoors.

Watch out for scams#

• Schokr staff will never ask for your password.
• Be wary of direct messages offering free credits, upgrades or help in exchange for your login or token.
• Only sign in at console.schokr.gg. Check the address before typing your password.

If you think your account or server was compromised#

1. Change your Schokr password right away, and your email password if it might be affected.
2. Check your teams for members you do not recognize and remove them.
3. Review the activity log on each server.
4. Regenerate any tokens, API keys and RCON passwords stored on your servers.
5. Restore a clean snapshot if files were changed.
6. Ask for help in the Schokr Discord.