Datadome

We are pleased to share that DataDome has successfully completed a new SOC 2 Type II report (April 2025 – March 2026). This independent assessment was conducted by Coalfire and covers the Security, Availability, and Confidentiality Trust Services Criteria across our entire Cyberfraud Protection Platform. The full SOC 2 Type II report is available in our Trust Center.

DataDome has signed the CISA Secure by Design Pledge, reinforcing our commitment to embedding security throughout the product lifecycle. This initiative aligns with our long-standing approach to building secure, resilient products by design. Learn more: https://datadome.co/data-privacy/commitment-cisa-secure-by-design-pledge/ https://www.cisa.gov/securebydesign/pledge/progress-reports

A recently disclosed Remote Code Execution (RCE) vulnerability affecting React Server and Next.js, tracked as CVE-2025-55182, may allow attackers to execute arbitrary code by abusing specific server actions and request patterns. ### Impact on DataDome DataDome does not use React Server or Next.js in the delivery of its services. As a result, DataDome’s infrastructure and platform are not affected by this vulnerability. DataDome provides an optional integration module for customers using these frameworks. This module is not impacted by CVE-2025-55182. A demo application previously offered to test the integration has been updated to use patched versions of the affected components. ### Recommendations for Customers If your applications rely on React Server or Next.js, we recommend that you: - Update to the latest patched versions of the affected frameworks. - Review any server actions in your codebase that could be exposed to RCE conditions. - Ensure your CI/CD pipelines and dependency management systems pull the patched releases. DataDome’s integration module does not require any updates, but your application components must be kept up to date to remain secure. ### DataDome Protection and Monitoring DataDome monitors and protects against malicious traffic patterns associated with this vulnerability. Our detection engine inspects: - Requests containing `next-action` or…

DataDome is monitoring the newly reported “Shai-Hulud 2.0” npm supply-chain campaign. After a thorough review of our build pipelines and dependencies, we confirm that no DataDome systems, products, or customer environments are impacted. We continue to maintain strict isolation, code-integrity controls, and continuous monitoring across all build and deployment pipelines. Based on all available intelligence and our internal assessments, we have found no evidence of compromise, malicious packages, or suspicious activity within our environment. We will provide additional updates if new information becomes available.

We are happy to share that our latest independent penetration test has been completed. The 2025 Penetration Test Attestations are now published and available for download directly from the DataDome Trust Center. Scope of the assessment The penetration test covered the full DataDome product suite: - DataDome Bot Protection - Account Protect - Page Protect - Ad Fraud Protect The assessment was performed by an independent third party using industry-standard methodologies ( OWASP Testing Guide).