8h ago
Security Incidents
One customer reported that someone obtained their VaultCord bot token and used it to wreck their Discord server (https://archive.is/qCLY0).
VaultCord also published an announcement about a significant vulnerability involving custom bots with Discord’s “user install” setting enabled (https://archive.is/PAA3u). According to the announcement, malicious actors could restore old account backups and roll a community back. VaultCord said the issue was reported by the owners of Cheap Now, Prism Boosts, and Boostly, that it is now fully fixed, and that “over 86% of users were never at risk.” The announcement also stated that no user data was read or changed and no database records were accessed or deleted, while placing responsibility on bot owners for their own settings and token security. As compensation, VaultCord gave four weeks of Plus to users whose servers had a backup or restore run via slash command in the previous 24 hours. Saying 86% were not at risk also means up to 14% of users were.
In Progress