Bot403

Security

Last updated: 2026-10-22. The operator of Bot403 ("the operator", "we") is Zahary Stoyanov Labs, Sofia, Bulgaria. Contact: [email protected].

  1. Bot403 runs on one server at Contabo GmbH, Germany, in the EU. Backups stay in the EU.
  2. All traffic uses TLS. The proxy in front of the app redirects HTTP to HTTPS and sends HSTS.
  3. Sign-in uses one-time links that expire after 15 minutes. There are no passwords to leak.
  4. Secret keys, session tokens and sign-in tokens are stored as SHA-256 hashes. A database dump does not contain a usable key.
  5. Every site has its own HMAC signing key for challenges, separate from the secret key, so a leaked secret key does not let anyone forge tokens.
  6. Tokens are single-use and expire after 10 minutes by default. The origin, difficulty and expiry are inside the signed challenge, so they cannot be edited.
  7. The server fetches no user-supplied URLs, so it cannot be used to scan internal networks. Origins are hostnames used only for matching.
  8. The dashboard sends a strict Content Security Policy and loads no third-party scripts, fonts or images. The browser script on your pages loads nothing from third parties either.
  9. The database is backed up every night and kept for 14 days. A restore is tested before each release that changes the schema.
  10. To report a vulnerability, email [email protected] with "security" in the subject. I answer within 1 business day and credit you in the changelog if you want that.