Report vulnerabilities affecting the current main branch to Akadil Alish (AQADIL). Use GitHub private vulnerability reporting when available. Otherwise, arrange a private channel through the owner's profile before sharing technical details.

Include the affected component, commit, reproduction steps and expected impact. Redact tokens, Telegram identifiers and personal information. Do not attach environment files, service-account credentials, student records or database exports.

Use only accounts, channels and data you are authorized to test. Obtain permission before testing the hosted service. Avoid production disruption, unsolicited Telegram messages, automated OTP guessing and paid API calls. Coordinate disclosure with the owner so a fix can be prepared.

If a credential is exposed, revoke or rotate it with its provider promptly. Deleting it from the current revision does not revoke it or remove historical copies. Keep private keys and bot/API tokens out of browser bundles, screenshots, issues and logs.

Ordinary bugs and feature requests belong in Issues; security details do not.