If you discover a security vulnerability, please DO NOT disclose it publicly. Instead, report it privately to our security team via [[email protected]]. We take security issues seriously and will investigate and resolve them as quickly as possible.

1. Report the issue via email with a clear description and proof of concept (if applicable).
2. Our team will acknowledge receipt within 48 hours.
3. We will investigate and provide a status update within 7 business days.
4. If a patch is required, we will issue an update and notify responsible parties.
5. We appreciate responsible disclosure and may acknowledge contributors who report valid vulnerabilities.

To ensure ChessCast remains secure and reliable, developers should adhere to the following security measures:

• Never expose API keys (e.g., Telegram Bot Token, database credentials) in your code.
• Use environment variables (.env) to store sensitive data.
• Example: Instead of hardcoding:

  BOT_TOKEN = "your-secret-token"

  Store it securely using:

  import os
  BOT_TOKEN = os.getenv("BOT_TOKEN")

• Limit database and API access permissions to only what is necessary.
• Avoid using admin credentials for general-purpose operations.

• Keep all libraries and dependencies up to date to patch security vulnerabilities.
• Run:

  poetry update

• Implement OAuth2, JWT, or API key authentication for external integrations.
• Enforce strong password policies for users.

If you have any security concerns or suggestions, please contact us at [[email protected]].

We appreciate your efforts in making ChessCast a secure and reliable platform!

Last Updated: March 2025