You still have your bot token in the config. Also the config is a shared script (as per your FXmanifest.)
Having bot tokens / webhooks on anything client/shared is very bad and could cause huge security issues they should never ever be in shared or client files.
This has nothing to do with what i said at all? You legit left YOUR bot token and Steam API key in the config… and config is shared… so clients can abuse it…