From 1e99ed9e5718e764ca043d16909c26cd4545b88e Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Wed, 6 May 2026 19:31:49 +0200
Subject: [PATCH] Security: ensure that a bot user is infact a bot when
 requesting a token reset

---
 src/api/routes/applications/#application_id/bot/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/api/routes/applications/#application_id/bot/index.ts b/src/api/routes/applications/#application_id/bot/index.ts
index a5eb31271..c25649bbd 100644
--- a/src/api/routes/applications/#application_id/bot/index.ts
+++ b/src/api/routes/applications/#application_id/bot/index.ts
@@ -66,7 +66,7 @@ router.post(
         },
     }),
     async (req: Request, res: Response) => {
-        const bot = await User.findOneOrFail({ where: { id: req.params.application_id as string } });
+        const bot = await User.findOneOrFail({ where: { id: req.params.application_id as string, bot: true } });
         const owner = req.user;
 
         if (owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;