me and some friends are working on a discord bot. for those unfamiliar, they’re server-hosted applications which users interact with via discord. users can issue them commands and the bot can interact with databases and web APIs server-side to respond to these commands.

in my threat model, my friends are considered potentially malicious developers. i want to ensure that any code running on the bot has been authored by me, or at least reviewed by me before its deployed in the discord.

part of my solution was to use a private github repo to host the bot’s source code. my friends can still clone this repo and develop the bot but can’t push unless they make pull requests and i review and approve their changes. my intention is that this will ensure there is a trusted code base.

however, i don’t know how to make sure that the bot deployed in discord is actually built from that trusted code. the bot will be hosted on a server which my friends own, although i will have access to it. how can i verify that the discord bot i’m actually interacting with through discord is built from the trusted code base?

any help is greatly appreciated 🙂