telegram-web-proxy-stack/SECURITY.md

Security policy

Do not open a public issue containing a client secret, bridge URL, access token, private key, .env file, Docker volume export or Portainer backup.

If sensitive data is exposed, revoke or rotate it first. Then contact the repository owner through a private Gitea channel and include only the minimum information needed to reproduce the problem.

Before publishing a change, run:

./scripts/audit-public.sh

The audit covers the current tree and every locally reachable Git commit. It is a guardrail, not a substitute for reviewing the diff and generated artifacts.