Last updated: 2026-08-25

This document describes how to report vulnerabilities and secure operational best practices for TPNEBOT.

The repository tracks a single active development branch (main). Version tags should reflect stable snapshots. Only the latest tagged release and main receive security attention.

1. Do not open a public issue for an unpatched vulnerability.
2. Contact maintainers privately (email or designated secure channel) with detailed reproduction steps.
3. Include: affected commit or tag, impact summary, potential exploitation scenario, suggested fix.
4. Expect acknowledgment within 72 hours and status updates until resolution.

• Validate report internally.
• Develop and test patch.
• Coordinate release and publish advisory in CHANGELOG or separate SECURITY_NOTICE.md.

If we become aware of unauthorized access to API data, Discord user data, or bot credentials, we will:

• Notify Discord through the appropriate developer support channels as required by the Discord Developer Terms of Service.
• Notify affected server owners and users to the extent we can identify them and as required by applicable law.
• Document the incident and remediation steps in a private incident log, and publish a sanitized public summary when appropriate.