Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability in Telepilot, please report it responsibly:

1. Email: Send details to the repository owner via GitHub's private vulnerability reporting feature.
2. GitHub Security Advisories: Use the Report a Vulnerability button in the GitHub Security tab.

Please include:

• A description of the vulnerability and its potential impact.
• Steps to reproduce the issue.
• Any proof-of-concept code (if applicable).
• Suggested mitigation or fix (if you have one).

You can expect an initial response within 72 hours and a resolution timeline within 7 days for critical issues.

• Never commit .env files, tokens, or credentials to the repository.
• Always use GitHub Actions secrets (Settings → Secrets and variables → Actions) for CI/CD.
• Rotate tokens immediately if they are accidentally exposed.

• Set TELEGRAM_WEBHOOK_SECRET to a long, random string and validate it on every incoming request.
• Use HTTPS exclusively for your webhook endpoint.
• Consider restricting inbound traffic to Telegram's IP ranges.

Telepilot requires the following minimum GitHub token permissions:

Use a GitHub App installation token rather than a long-lived PAT wherever possible.

The following webhook events should be subscribed to if using the GitHub App integration:

• push — optionally notify Telegram on new commits
• pull_request — trigger automated PR summaries
• issues — optionally post issue summaries to Telegram

• Use ALLOWED_TELEGRAM_USERS to restrict bot access to known Telegram user IDs.
• Rotate all secrets periodically and immediately after any suspected compromise.

We are committed to working with security researchers to quickly resolve vulnerabilities. We will credit researchers who responsibly disclose issues (with their permission).