At Crystal Studio Labs, we take the security of Crystal Uptime seriously. Thanks for helping us keep the project — and the bots/databases it connects to — safe.

Please do not open a public issue for security problems. Instead, report privately:

• 📧 Email: connect.crystalstudio@gmail.com
• 🐙 GitHub: use the private vulnerability reporting feature on this repository.

1. Affected file(s) / endpoint(s) and the version.
2. A step-by-step description of the exploit (or a minimal PoC).
3. Impact and any mitigations you've found.
4. Your contact info (optional).

You can expect an acknowledgement within 48 hours and a detailed response with next steps as soon as possible. We'll coordinate a fix and disclose responsibly — credit goes to the reporter unless anonymity is requested.

• 🔐 No secrets in the repository — all credentials are read from the environment (see .env.example). Configuration is 100% env-driven.
• 🚫 Sensitive files are gitignored — .env*, *.sqlite, planning/memory files, and local databases are excluded from version control.
• 🔑 Website sessions store only sha256 token hashes, never raw tokens; cookies are httpOnly.
• 🔄 Deprecated credentials that previously shipped in this repo's history were rotated by the owner. If you believe a token was exposed, rotate it immediately.
• 🛡️ Free-tier hosting caveat — on sleeping free PaaS tiers the bot's Discord gateway disconnects while asleep; this is a platform limitation, not a vulnerability.

In scope: the Crystal Uptime repository and the software it builds. Out of scope: the Discord API, hosting platforms, and third-party dependencies (report those to their respective maintainers).