We treat the security and privacy of TelegramWarden installations seriously. If you find a security vulnerability, please report it responsibly by following the instructions below.

Security fixes are released for the active main branch and current stable tagged versions.

Do not report security vulnerabilities in public GitHub issues, pull requests, or public discussions.

To report a vulnerability safely:

1. GitHub Security Advisories (Preferred): Open the repository on GitHub, navigate to the Security tab, select Report a vulnerability, and submit your report privately.

2. Direct contact: If private advisory reporting is unavailable, reach out directly to the maintainer on Telegram: @ivanchikbyte.

To help us investigate and patch the issue quickly, include:

• A clear summary of the vulnerability type (for example, authentication bypass, SQL injection, token leakage, unauthenticated endpoint access, or rate-limit evasion).
• The specific files, endpoints, or handlers affected.
• Step-by-step instructions to reproduce the issue, including example requests or payloads where applicable.
• The expected security impact and affected configurations.
• Any suggested fix or remediation steps you have identified.

1. Acknowledgment: We will acknowledge your report within 48 hours of receipt.
2. Assessment: We will confirm the issue, determine severity, and assess affected components within 5 business days.
3. Fix and verification: We will develop and test a fix in a private branch.
4. Coordinated disclosure: Once a release with the fix is available, we will announce it and credit your responsible disclosure (unless you prefer to remain anonymous).