zlacker

>>exists+(OP)
> A recent security breach on our platform brought BotGhost to Discord’s attention.

The breach in question is documented here: https://youtube.com/watch?v=lUiLBBab1RY

I don’t think there’s a text write-up, but tl;dw a combination of missing input sanitization and no-code UI trickery made it possible to leak other users’ bot tokens, and despite patching the exploit pretty quickly on exposure, BotGhost’s developer tried to cover it up and refused to reset potentially affected tokens.

>>nxrabl+dk
Maybe uncharitable, but it seems like BotGhost comprehensively doesn't take security seriously. Not only were there bad vulnerabilities, but they didn't have the logging (or didn't use it) to see who was affected; didn't want to roll keys; didn't want to announce; and didn't even have their own bots use their own security features. So yeah. I'm a bit more sympathetic if Discord decided that BotGhost in particular wasn't going to be using Discord's platform any more. Because I'd guess the probability these are the last of BotGhost's serious vulnerabilities to be about 0%.

So now botghost is doing a pentest. But I dunno... my guess at the likelihood of doing a good job backfilling security into a codebase that wasn't built with that as a core concern is also low.