Report a security issue
Report vulnerabilities privately, with affected version, minimal reproduction steps, impact and sanitized evidence. Do not include passwords, bot tokens, keys, MFA secrets or personal message content.
Assess only systems you own or are authorized to test. Avoid disruption, production tag changes and accessing other users’ data. Coordinate disclosure; no bounty or fixed response time is promised. Agree a secure channel before sharing sensitive evidence.