Please do not open a public issue for a suspected vulnerability and do not send credentials, tokens, Telegram initData, user data, uploaded files, or proof-of-concept payloads that could harm a live service.

Use GitHub’s private vulnerability-reporting feature for this repository when available. Include:

• a concise description and impact;
• affected file/version and deployment assumptions;
• safe reproduction steps;
• a proposed mitigation if you have one.

Maintainers will acknowledge valid reports as soon as practical and coordinate a fix before disclosure.

Never commit or publish:

• BotFather tokens or Telegram webhook secrets;
• provider keys, billing credentials, or authorization headers;
• config.php or unzipper/config.php;
• account directories, clone registries, runtime state, history, temporary files, archives, backups, or logs;
• real Telegram Web App initData or signed download URLs;
• personal Telegram IDs unless you explicitly intend to publish them.

If a credential is exposed, revoke or rotate it immediately and audit access logs. Removing it from a later commit does not make the original exposure safe.

The project aims to maintain HTTPS-only secret submission, signed Telegram identity validation, encrypted credential storage, tenant isolation, bounded archive/agent/provider operations, direct-helper denial, and fail-closed lifecycle controls. Deployment configuration and host hardening remain the operator’s responsibility.