Security fixes target the latest public main branch unless a release branch is explicitly marked as supported.

Do not open a public issue for secrets, authentication bypasses, deployment keys, or notification-token exposure. Use GitHub's private vulnerability reporting to contact the maintainer confidentially.

Please include:

• affected version or commit;
• deployment mode;
• steps to reproduce;
• impact;
• any logs with secrets removed.

Never commit:

• .env files except .env.example;
• .ops-private/;
• VPS SSH keys or host fingerprints;
• production database dumps;
• Rubika bot tokens or chat IDs;
• Setad credentials.