The main branch receives security fixes.
Please report security issues privately to the repository maintainer. Do not open a public issue for credential leaks or remote exploits.
Include:
- affected version / commit
- reproduction steps
- impact assessment
If an API token or bot token is exposed:
- Revoke/rotate it immediately at the provider
- Redeploy with the new secret
- Audit logs for unexpected usage