Please report security vulnerabilities privately to me or the forked repository owner/maintainer. If the repository is hosted on GitHub and private vulnerability reporting/security advisories are enabled, use that channel. Do not open a public issue containing exploit details, credentials, customer data, wallet/provider tokens, or live server endpoints.

Include enough information to reproduce and assess the issue safely:

• affected version/commit;
• affected route/component;
• prerequisites;
• reproduction steps using non-sensitive test data;
• impact;
• any suggested mitigation.

Changes touching these areas require extra review and regression testing:

• authentication, CSRF, session handling and role/scope checks;
• SecretVault and application-key handling;
• XUI/UM remote credentials and proxies;
• reseller wallet/ledger mutations;
• TON invoice settlement and direct Shop fulfillment;
• reseller API encryption/API keys;
• Panel Sync secrets and cross-installation re-encryption;
• JSON transactions/locks/rollback;
• public customer access and rate limiting.

See docs/SECURITY.md for the implementation/operations security model.