Security updates are handled for the latest GINBOT release.

If you find a vulnerability, contact the repository owner privately through GitHub. Do not open a public issue containing sensitive information.

Do not include:

• API keys
• Telegram bot tokens
• Railway secrets
• Private route data
• Home or Work addresses
• Exact coordinates
• Raw production logs containing private values

If a credential is exposed, rotate it immediately with the provider, update the deployment variable, and restart the single GINBOT worker.

GINBOT stores credentials in environment variables. The project includes best-effort secret redaction for logs, but users and contributors should still avoid posting private logs or route data publicly.