Security fixes are applied to the latest revision of the main branch.

Please use the repository's Security → Report a vulnerability form (GitHub Private Vulnerability Reporting). Do not open a public issue for a vulnerability and never include live bot tokens, database credentials, webhook secrets, session strings, or private message contents in a report.

If private reporting is not enabled, contact the repository owner through their GitHub profile and ask for a private channel before sharing technical details.

• Keep .env out of Git and rotate any credential that has been exposed.
• Use a unique, randomly generated WEBHOOK_SECRET and HTTPS for webhook deployments.
• Restrict database and backup access: Vaulty stores message text and metadata in the database.
• Do not log request URLs, headers, update bodies, or environment variables at the reverse proxy.
• Run one polling process per bot token, or one webhook deployment behind a trusted reverse proxy.
• Keep Python packages and GitHub Actions updated; Dependabot is configured for both.

Managed sub-bot tokens are fetched from Telegram when needed and are not persisted by Vaulty. The main bot token remains an environment secret.