Security fixes are applied to the latest version on the default branch.

Do not create a public issue for a suspected vulnerability or exposed credential. Contact the project maintainer through a private channel and include a concise description, reproduction steps, affected versions, and any mitigation already applied.

Do not include live tokens, passwords, webhook secrets, or personally identifiable data in the report. If a credential may have been exposed, revoke or rotate it immediately.

• Keep all secrets in environment variables or your hosting provider's secret store.
• Use a least-privilege bot invite and test configuration changes in a non-production server first.
• Enable only the Discord intents required by the enabled features.
• Restrict MongoDB network access and use an authenticated connection string in production.
• Review dependency audit results before publishing a release.