Open a GitHub issue. Do not include a real credential in it - describe the shape of the problem instead. If a finding is sensitive, say so in the issue without the details and I will follow up privately.

This is a personal alert bot: one machine you control, one Telegram chat, a handful of public data feeds. It exposes no listening port that reads anything. The realistic risks are:

1. The bot token. It is read from the environment or from token.txt next to the scripts, which is git-ignored and excluded from the package build by a gate that refuses to produce the zip if anything shipped looks like a credential. Some urllib errors quote the URL they failed on, and the token is in that URL: the error path scrubs it before anything is logged. If it leaks anyway, revoke it with @BotFather.
2. Untrusted content in the message. Callsign, type, operator, route and airline come from ADS-B broadcasts and a public database. All of it is HTML-escaped before it becomes Telegram markup, URL-quoted before it becomes a link, and the airline code is shape-checked before it is used to build the logo URL that Telegram fetches on your behalf. The self-test exercises a hostile callsign and a hostile airline.
3. Follow mode: someone else steering the alerts. The bot long-polls Telegram, so anyone who finds it can send it a location. Only messages from the owner chat are acted on; the rest are consumed and dropped. The owner's position is held in memory and never written to disk or to the log.
4. Privilege on Windows. The kit runs the bot as SYSTEM out of the folder you extracted it to. The heartbeat file is opened O_NOFOLLOW so a planted symlink cannot make SYSTEM truncate a file of someone's choosing. Put the folder somewhere ordinary users cannot write - see winservice-kit for why a folder under C:\ is not that place.
5. Resource exhaustion. A feed answer is read up to a fixed size and no further; the seen-aircraft table is pruned every cycle.

• The accuracy of public ADS-B data. It is crowd-sourced and unverified; this is a curiosity, not a safety tool.
• Defending against an attacker who is already root or Administrator, or who has your Telegram account.
• Multi-tenant use. One chat, one owner.

Do not paste the token into run.bat, config.env.example, or anything you might zip. token.txt and the environment exist for that reason.