BotGhost security

Is BotGhost safe?

Yes. Your bot's token is encrypted, it's only ever sent to Discord to run your bot, and nobody can read it back from the dashboard once you've saved it, not even you. Marketplace packs that touch tokens or Secrets are checked by a person before anyone can install them, and BotGhost never asks for your Discord password.

Your bot is still a Discord application you own, so you can reset its token at any time and the old one stops working straight away.

Your bot token

• We only use your token to run your bot, and it's only ever sent to Discord.
• It's encrypted when it's stored and when it moves between our servers.
• Once you save it, the dashboard never shows it again.
• Collaborators can't see it or change it.
• Deleting your bot on BotGhost deletes its token, commands, and settings.

Collaborators and Secrets

You choose what each collaborator can do on your bot. Collaborators can't see the token, and someone without permission to manage Secrets can't make your bot use them.

Secrets is where you keep API keys for other services. Once saved, a Secret can't be read back by anyone, you included. Blocks use it by name, so the key itself never appears in a command.

Commands you import

Marketplace packs are checked before they're listed. A pack that uses a bot's token or Secrets, or sends your server's data to another website, isn't passed automatically: a person on our team looks at it first. Installing a pack like that needs permission to manage Secrets.

Share codes come straight from other people and aren't reviewed. Before you switch on an imported command, open it in the builder and look at what each block does, the same as you would with code someone sent you.

What happened in 2025

In June 2025, security researchers reported two problems to us: a flaw with interaction tokens, and old API routes that could be used to read sensitive data, bot tokens included. Both were fixed as soon as they were found, the API routes within hours of the report. Fewer than 100 bots were affected. We contacted every affected owner directly, apologised, and compensated them, and we paid bounties to the researchers who reported responsibly.

Separately, Discord sent BotGhost a notice under its Developer Policy 4 about using bot tokens to run bots at all, with a deadline of 14 July 2025. Discord's notice wasn't about the security reports. BotGhost kept running through it and is still running today.

How it works now:

• The token is never shown again after you save it, and collaborators can't see it.
• Marketplace packs that touch tokens or Secrets wait for a person to review them.
• API keys live in Secrets, where they can't be read back.
• We review every part of BotGhost that handles a token or a Secret whenever it changes.

Hosting and your data

BotGhost runs your bot on Amazon Web Services (AWS). Your data is encrypted when it's stored and when it moves between our servers, including your email address and your bot's token. You can read about AWS's own measures on their security overview page.

Payments

Subscriptions are paid through Stripe or PayPal, which both meet PCI Level 1, the highest security standard for handling cards. BotGhost never stores your card details; Stripe or PayPal keeps them. App Store purchases are handled by Apple.

Keeping your server safe

• Give your bot only the permissions it needs. Leave Administrator off unless a feature really needs it.
• Turn on two-factor authentication for your Discord account, since it controls the Developer Portal, and for the Google, Apple, GitHub, X, or email account you sign in to BotGhost with.
• Only add collaborators you trust, and give them the smallest role that works.
• If your bot does something you didn't build, reset its token in the Developer Portal and paste the new one into BotGhost.

Questions people ask

Did BotGhost shut down?

No. BotGhost is running and bots are online. In June 2025 Discord sent BotGhost a notice about using bot tokens to run bots, with a deadline of 14 July 2025, and BotGhost kept running through it. The security problems reported that same month were fixed as soon as they were found.

What happens to my token if I delete my bot?

Delete your bot on BotGhost and we wipe its token, commands, and settings. The Discord application stays in your Developer Portal, so reset its token there too if you want to be sure nothing can use the old one.

Can I export my bot from BotGhost?

One command or event at a time. Each one can be shared as a share code and imported on another bot. There isn't a way to export a whole bot in one file yet.

Bug bounty program

BotGhost values the security of our platform and appreciates the security research community's efforts in helping us maintain a secure environment. We offer bug bounties for the responsible disclosure of critical security vulnerabilities and exploits.

Terms and conditions

To be eligible for a bug bounty reward, security researchers must adhere to the following terms and conditions:

• You must provide a detailed report of all accessed resources and the steps to reproduce the vulnerability.
• You must not have shared the vulnerability details, reproduction steps, or any information about the exploit with any other entities prior to receiving the bounty.
• You may share the vulnerability information publicly only after it has been patched and we have provided explicit confirmation.
• You must not have used the accessed resources or vulnerability for any malicious intent or unauthorized access.
• The vulnerability must be a genuine security issue that poses a critical risk to our platform or users.
• BotGhost reserves the right to determine the severity and eligibility of reported vulnerabilities.

How to contact us

Please feel free to contact us if you have any questions or comments about BotGhost's security at [email protected].