The bot is actively maintained and security updates apply to the following versions:

Older releases are not guaranteed to receive patches.

If you discover a security issue, please do not open a public GitHub issue.

Instead, contact me directly at:

andy.gonzalez0205@gmail.com
(or GitHub private security advisories)

I will review and respond as soon as possible.

• This project follows best practices for handling secrets and tokens.
• The bot should always run using environment variables and never hard-coded secrets.
• If you deploy on a VPS or Raspberry Pi, ensure the system is up to date and SSH is secured.

Please give me as much detail as possible when reporting security issues so I can reproduce the problem and patch it quickly.