2h ago
VaultCord Security Incidents
One VaultCord customer reported that someone got hold of their VaultCord bot token and used it to wreck their Discord server (https://archive.is/qCLY0).
VaultCord also published an announcement about a significant vulnerability affecting custom VaultCord bots with Discord’s “user install” setting enabled (https://archive.is/PAA3u). According to VaultCord, malicious actors could restore old account backups and roll a community back. VaultCord credited the owners of Cheap Now, Prism Boosts, and Boostly with reporting the issue and said it was fully fixed. VaultCord stated that no user data was read or changed and no database records were accessed, while also placing responsibility on bot owners for their own settings and token security.
VaultCord said “over 86% of users were never at risk,” which also means up to 14% of VaultCord users were. As compensation, VaultCord gave four weeks of Plus to users whose servers had a backup or restore run via slash command in the previous 24 hours.
In Progress