Please use GitHub's private vulnerability reporting or security advisory feature for this repository. Do not open a public issue for an undisclosed vulnerability.

Include:

• affected commit or release
• reproduction steps
• expected impact
• suggested mitigation, if available

Never include real Telegram bot tokens, webhook secrets, administrator IDs, or production message content. Revoke and rotate any credential that may have been exposed.

Security fixes are applied to the latest version on the default branch.