If you got a system DM saying your token was found here, it's because someone found your bot or user token, and someone was kind enough to submit it here. When your token is posted in this repository, it will cause your token to be reset and your bot to go offline. For bot tokens, you will get a system DM from Discord notifying you that your bot was compromised. For user accounts, you get an email from Discord explaining your account was compromised.
In the tokens.md file you can see where where your token was found, make sure your don't post your new token here again.
Your code on replit is public. This means anyone can look at it and find your token. While I simply chose to invalidate the token, it does not mean others will do the same. The token gives full access to the account, bypassing all other requirements like the password. This allows others to control your bot for malicious purposes. Keep your token safe!
For any questions, you are free to DM
Sammy#1001on Discord.
Use secrets. These are private and cannot be viewed by others, allowing you to continue running your code without the risk of having your tokens stolen.
You can use our Token Invalidator to add tokens to this repository.
The source code for the invalidator is available here.