That's why I designed my bot to have a very small core, with most other things being plugins, from the start. I also containerized everything and made it so the bot never sees API keys as well.

https://stavrobot.stavros.io if you're interested in the design decisions.