Botlify Security Sandbox & Compliance Guide

Understanding the Botlify Security Sandbox

All Telegram bots hosted on Botlify Cloud execute inside an isolated Per-Bot Security Sandbox. This engine ensures complete isolation between bot environments, prevents unauthorized system operations, shields platform configuration files, and safeguards server integrity.

How Code Auditing Works

Before any bot code is saved in the Code Studio or executed by incoming Telegram webhooks, it passes through BotlifySandbox::auditCode() using PHP's native tokenizer (token_get_all) for Abstract Syntax Tree (AST) inspection:

Intelligent Token Parsing (No False Positives) The sandbox strictly parses PHP tokens. Backticks inside Telegram Markdown strings ("Your ID: `12345`") and MySQL table names (SELECT `id` FROM `users`) are recognized as T_CONSTANT_ENCAPSED_STRING and permitted without restrictions.

Permitted Code Patterns

Telegram Markdown Backticks: bot('sendMessage', ['text' => "Use `help` to start"]); — Fully Allowed.
SQL Table Backticks: $pdo->query("SELECT `name`, `status` FROM `users`"); — Fully Allowed.
Telegram Commands: Commands such as /home, /root, /start, and /settings — Fully Allowed.
Object Method Calls: Methods like $pdo->exec() and $class->system() — Fully Allowed.
Modular Inclusions: require_once __DIR__ . '/config.php'; — Fully Allowed.

Prohibited Functions & Security Violations

The following operations are strictly blocked inside the sandbox and will prevent code from saving:

Shell Execution Operator: Shell backtick execution (`ls -la`).
Process & Shell Functions: exec(), shell_exec(), system(), passthru(), proc_open(), popen().
Dynamic Evaluation: eval(), assert(), create_function().
System Root File Access: Accessing paths like /etc/passwd, /var/log, or /home/user/... outside the bot's dedicated workspace directory.
Platform Internal Functions: Platform core functions such as fbh_pdo() or accessing platform root configuration files.