Do not open a public GitHub issue for vulnerabilities involving:

• Discord bot tokens;
• Roblox Open Cloud API keys;
• HMAC command secrets;
• permission bypasses;
• forged or replayed moderation messages;
• SQL integrity issues;
• sensitive audit data exposure.

Contact the repository owner privately through the security contact configured on the GitHub profile or repository.

Include:

• affected version or commit;
• reproduction steps;
• expected and actual behavior;
• impact assessment;
• suggested mitigation, if available.

Never commit:

• .env;
• Discord tokens;
• Roblox Open Cloud keys;
• ROBLOX_COMMAND_SECRET;
• production JSON database files and database backups;
• PostgreSQL connection URLs;
• raw authorization headers;
• production logs containing user data.

If a secret reaches Git history, rotating the secret is mandatory. Removing the file in a later commit is not sufficient.

Security fixes target the latest release on the main branch.

• Roblox User Restrictions is the persistent access-control authority.
• Discord roles and guild membership are verified in application code.
• Messaging Service delivery is best effort.
• The HMAC secret in Roblox server code is less protected than secrets stored only on the external bot server.

PINGUS // Protect the keys. Verify the state. Trust user IDs.