security: Discord bot API_URL hardcoded to localhost in bot/.env.example — bot silently sends all member data and point transactions to a non-existent server in production deployments

[divyanshim27]

Summary

bot/.env.example documents:
API_URL=http://localhost:5000/

The Discord bot (bot/) communicates with the Express server exclusively
through API_URL — every point award, task verification, and leaderboard
fetch is an HTTP call to this value. In a production deployment (the README
documents Cloudflare deployment via wrangler.toml), localhost:5000 does
not resolve to the backend — it resolves to nothing.

Exact Impact

When a community member runs /award or /verify on the Discord bot in
production:

1. bot/index.js fires fetch(\${process.env.API_URL}/api/points/award`)`
2. The request targets http://localhost:5000 — unreachable in production
3. The bot silently swallows the connection error or returns a generic failure
4. Points are never actually awarded — but the Discord user receives no
   error message explaining why, leading to confusion and trust erosion in
   the gamification system

Additionally, bot/.env.example is missing FRONTEND_URL (needed for
leaderboard links posted to Discord), EMAIL_USERNAME, and
EMAIL_PASSWORD — which are documented in server/.env.example but have
no corresponding entry in the bot's env template. New contributors
copy-paste the bot env without these values and have no indication anything
is missing.

Proposed Fix

Update bot/.env.example:

# Discord bot token from https://discord.com/developers/applications
DISCORD_TOKEN=your_discord_bot_token

# Guild/server ID — right-click server → Copy Server ID (developer mode)
GUILD_ID=your_guild_id

# URL of the deployed Gamify API server
# Local development: http://localhost:5000
# Production: https://your-deployed-server.com
API_URL=http://localhost:5000

# Frontend dashboard URL (used in leaderboard embeds posted to Discord)
FRONTEND_URL=http://localhost:5173

Also add a startup validation in bot/index.js:

if (process.env.API_URL === 'http://localhost:5000' &&
    process.env.NODE_ENV === 'production') {
  console.error('[FATAL] API_URL is set to localhost in production. Update bot/.env');
  process.exit(1);
}

Acceptance Criteria

• bot/.env.example updated with FRONTEND_URL and corrected comments
• Startup validation added to bot/index.js for production localhost check
• DEPLOYMENT_GUIDE.md updated to explicitly list the API_URL
  configuration step for bot deployment

Labels: bug, security, bot, documentation, `level: beginner'

[github-actions]

Thank you for raising this issue!

We'll review it as soon as possible. We truly appreciate your contributions! ✨

Meanwhile make sure you've visited the README.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md before creating a PR for this. Also, please do NOT create a PR until this issue has been assigned to you. 😊

[divyanshim27]

Hey @DeadIndian ,
I have deeply gone through the project repo and understood and analysed the project through local running & testing , based on which I found this as major lagging/point of enhancement .
Based on my skill-set and problem understanding , I would want to work on the issue and contribute to the repo.
Please assign it to me.

[Keshavsspppp]

Hi,could you assign this issue to me?