Security fixes are applied on the default branch (main). Older tags/releases may not receive backports.

Do not open a public GitHub issue for security bugs or leaked credentials.

Email [email protected] with:

• A short description of the issue
• Steps to reproduce or a proof of concept
• Impact (e.g. auth bypass, data exposure, SSRF)
• Your preferred contact for follow-up

Please allow a reasonable time for a fix before any public disclosure.

Never commit .env files, API keys, webhook URLs, or service-account JSON. Use .env.example as a template (names only).

If you accidentally push a secret, rotate it at the provider immediately and treat the git history copy as compromised.