SECURITY.md

Security Policy

Found a vulnerability? Please report it privately — open a GitHub issue without exploit details in the public text, or message the bot owner directly.

Helpful reports include: where (file and line), what an attacker could do, and how to reproduce it in a test environment. Never send live keys or tokens.

Secrets in .env and environment variables are never committed (see .gitignore). If a key has leaked, say so directly and it will be rotated.