Security at BotDigit
Our multi-layered defense architecture safeguards escrow funds, smart contract automation, client intellectual property, and user privacy across the entire platform.
PHP2Shell Remote Code Execution Vulnerabilities
Critical PHP security vulnerabilities affect unpatched PHP runtimes. BotDigit infrastructure is unaffected. Read our remediation guide for affected branches, fixed upstream versions, and legacy server hardening.
Escrow Multi-Sig Vaults
Milestone funds are secured with non-custodial multi-signature contracts and time-locked release triggers.
NIST Data Sanitization
Strict SP 800-88 compliance across all infrastructure, retired hardware, and temporary dev sandbox containers.
Hardened Rust Gateways
High-performance memory-safe Rust services with strict rate limiting, mTLS inter-service comms, and CSRF protection.
Continuous Red Teaming
24/7 vulnerability scanning, external penetration tests, and an active community bug bounty program.
Global Runtime Vulnerability Disclosures
PHP2Shell Remote Code Execution in C-Runtime
Critical boundary buffer overflows in multipart form ingestion and FastCGI desynchronization affect unpatched PHP runtimes (8.2, 8.3, 8.4, 8.5 & EOL). Composer or CMS updates will not resolve it—OS binary patching is required.
Node.js Brotli Decompressor Memory Corruption
Heap memory corruption in bundled node:zlib Brotli decompressor prior to 22.23.4, 24.22.1, and 26.12.1. Note that npm audit cannot fix this flaw; hosts, PM2 daemons, and Docker images must be upgraded.
Security Researcher Hall of Fame
We honor independent ethical hackers and researchers who help keep BotDigit secure through responsible vulnerability disclosure.
View Hall of FameBug Bounty Program
Discover and report security issues according to our coordinated disclosure guidelines. Eligible reports receive official certificates, permanent Hall of Fame honors, profile badges, and non-cash platform recognition.
Explore Bug Bounty GuidelinesReport a Security Vulnerability
If you believe you have discovered a vulnerability, please encrypt your report using our PGP key and email [email protected]. We acknowledge all reports within 24 hours.