Do not open public issues for vulnerabilities or leaked secrets.

Report security concerns privately to the repository owner. Include the affected commit, file path, reproduction steps, and any logs or screenshots that help confirm the issue.

If you accidentally exposed a Telegram bot token, database URL, invite link, chat ID, or private form URL, rotate it before publishing the repository.