We take the security of HasiiMusicBot seriously. We appreciate your efforts to responsibly disclose any security vulnerabilities you find.

If you discover a security vulnerability within this project, please report it immediately and privately. Please DO NOT open a public GitHub issue.

To report a vulnerability, please contact the project maintainer directly on Telegram:

Telegram User: @Hasindu_Lakshan

In your report, please include:

1. Vulnerability Description: A clear and detailed explanation of the security issue
2. Reproduction Steps: Detailed steps to reproduce the vulnerability (including necessary configuration, code snippets, or logs)
3. Version Information: The version of the project you are using (commit hash, release tag, or branch name)
4. Impact Assessment: Your assessment of the potential impact and severity
5. Suggested Fix: (Optional) Any recommendations for fixing the vulnerability
6. Disclosure Timeline: Your preferred timeline for public disclosure (if applicable)

• Initial Response: We will acknowledge your message within 48 hours
• Status Updates: Regular updates on the investigation and fix progress
• Resolution: We aim to provide a fix or mitigation within 7-14 days for critical vulnerabilities
• Credit: Security researchers will be credited in the release notes (unless anonymity is requested)

To ensure you have the latest security patches and features, we strongly recommend running the latest stable release of HasiiMusicBot.

Security updates will generally be provided for the following versions:

⚠️ Important: If you are running an older version, please upgrade as soon as possible to receive security fixes and the latest features.

As HasiiMusicBot is a self-hosted Telegram bot, users are responsible for implementing critical security practices:

• Never Expose Secrets: Never commit your Telegram Bot Token, API ID, API Hash, MongoDB URI, Session Strings, or any other sensitive credentials to version control
• Use Environment Variables: Store all credentials in .env files (never commit these to git)
• Rotate Credentials: Regularly rotate bot tokens and session strings, especially if you suspect compromise
• Session String Security: Pyrogram session strings have the same access as your Telegram account - protect them carefully
• MongoDB Security: Use strong passwords and enable MongoDB authentication; restrict network access
• Cookie Files: If using YouTube cookies for age-restricted content, ensure they're stored securely and not committed to git

• Trusted Environments Only: Run the bot only on secure, trusted systems with restricted access
• Firewall Configuration: Configure firewalls to allow only necessary inbound/outbound connections
• User Permissions: Run the bot with minimal required system permissions (avoid root/administrator)
• Log Security: Protect log files from unauthorized access as they may contain sensitive information
• VPS/Server Hardening: Keep your hosting environment patched and secure

• Regular Updates: Keep all Python packages updated to patch known vulnerabilities

  pip install -U -r requirements.txt

• Dependency Auditing: Periodically check for vulnerable dependencies

  pip install safety
  safety check -r requirements.txt

• System Dependencies: Keep FFmpeg, Deno, and system packages updated
• Python Version: Use supported Python versions (3.10+) with active security updates

• Owner ID Protection: Set OWNER_ID to your Telegram user ID only; never share owner privileges
• Sudo User Management: Carefully manage sudo users - they have elevated bot permissions
• Blacklist Feature: Use the blacklist feature to block abusive users or chats
• Authorization System: Use the /auth command to grant playback permissions selectively
• Admin Verification: Ensure the bot verifies admin status before executing privileged commands

• Regular Log Reviews: Monitor log.txt for suspicious activities or unauthorized access attempts
• Database Backups: Regularly backup your MongoDB database
• Incident Response Plan: Have a plan for responding to security incidents:
  1. Revoke compromised credentials immediately
  2. Review logs for unauthorized access
  3. Assess data exposure
  4. Notify affected users if necessary
  5. Update credentials and redeploy
• Rate Limiting: Be aware of Telegram's rate limits to prevent abuse

• ❌ Don't: Commit .env files or session files to GitHub
• ❌ Don't: Share screenshots containing bot tokens or API credentials
• ❌ Don't: Use the same bot token across multiple deployments
• ❌ Don't: Run the bot with root privileges
• ❌ Don't: Expose MongoDB to the public internet without authentication
• ❌ Don't: Ignore dependency update warnings
• ❌ Don't: Share your Pyrogram session strings (they provide full account access)

• Telegram Bot Security Best Practices
• Python Security Best Practices
• MongoDB Security Checklist

We follow responsible disclosure practices. Security researchers who report vulnerabilities responsibly will be:

• Acknowledged publicly (unless they prefer to remain anonymous)
• Credited in release notes and security advisories
• Given reasonable time to verify fixes before public disclosure

This software is provided "as is" under the GNU General Public License v3.0 (GPL-3.0). While we strive to maintain security, users are responsible for their own deployments and should follow best practices outlined above.

Last Updated: August 22, 2026
Contact: @Hasindu_Lakshan on Telegram