botmesh is currently in an alpha stage. Security fixes are applied on a best-effort basis to the latest actively maintained code.

Do not expose an unmaintained deployment directly to the internet. Pin exact package versions and review release notes before upgrading.

Please do not open a public issue for suspected vulnerabilities.

Use a private GitHub Security Advisory and include:

• Affected package and version or commit.
• Impact and required preconditions.
• Minimal reproduction or failing test.
• Suggested mitigation, if known.
• Whether the issue is already public or actively exploited.

Avoid including real credentials, session data, QR codes, access tokens, message contents or personally identifiable information.

If private reporting is unavailable, contact the repository maintainer through the contact method shown on the GitHub profile and share only enough information to establish a private channel.

The maintainers will aim to:

1. Acknowledge the report and confirm whether it can be reproduced.
2. Assess affected packages and supported versions.
3. Prepare a regression test, fix and operational mitigation.
4. Coordinate a release and advisory before public disclosure.

Please allow time for a coordinated fix. Public disclosure may need to be delayed when it would expose users before a patched release is available.

• Treat provider sessions and auth state as long-lived credentials.
• Keep webhook secrets, API keys and encryption keys outside source control.
• Require authentication and authorization for management APIs.
• Validate webhook signatures against the original request bytes.
• Limit request bodies, media downloads, redirects, execution time and concurrency.
• Use TLS and a trusted reverse proxy.
• Redact tokens, QR payloads, message bodies and personal data from logs.
• Isolate tenants, bots, providers and channel connections in storage keys.
• Define retention, export and deletion policies for message data.
• Back up stores and test restoration.

Reports are welcome for:

• Packages under packages/.
• Official templates generated by create-botmesh.
• Authentication, webhooks, session handling, storage and management APIs.
• Cross-tenant or cross-bot isolation failures.
• Vulnerabilities caused by official plugin or provider contracts.

Third-party services, unofficial community plugins, unsupported package versions and social engineering are outside the direct maintenance scope, although integration weaknesses may still be reported when BotWA contributes to the impact.

Security hardening is tracked as the first gate in ROADMAP.md. Sensitive reproduction details should remain in private advisories or private issues until remediation is available.