Please do not report security vulnerabilities in public issues.

Send a private report through the Telegram community contact:

https://t.me/+6dcMgO8XsN41NWNl

Include:

• Affected version or commit.
• Clear reproduction steps.
• Impact and affected component.
• Any logs or screenshots with secrets fully redacted.

Never include bot tokens, private keys, database passwords, payment provider tokens, production .env files, or customer data in issues, pull requests, logs, screenshots, or test fixtures.

Security fixes target the current main branch unless a maintained release branch is documented separately.