Noticed that contribute.py has the bot token hardcoded on line 7:
BOT_TOKEN = "Z2l0aHViX3BhdF8xMUFYS0pGVFkwU2VhNW9ORjRyN0E5X053WDAwTVBUUU5RVUNTa2lNNlFYZHJET1lZa3B4cTIxS091YVhkeVhUYmRQMzdVUkZaRWpFMjlRRXM5"
It's base64 encoded but that's not really protection - takes 2 seconds to decode. Since this is a public repo anyone can grab it.
Should probably move this to an environment variable like os.environ.get('CONCORE_BOT_TOKEN') or something. Also might want to rotate the current token since it's already out there.