Do not open a public issue. Instead, please report security vulnerabilities privately by following these steps:

1. Go to the repository's Security Advisories page
2. Click "Draft a new security advisory" or "Report a vulnerability"
3. Describe the vulnerability in detail, including steps to reproduce and potential impact

You can also email the maintainers at security@example.com.

We aim to acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.

• All credentials are passed through environment variables only — never hardcoded
• The .env file is excluded from version control
• Docker containers run as non-root with read_only: true, no-new-privileges, and cap_drop: ALL
• The API token is never exposed to the frontend — all Chatwoot API calls go through the backend