01
Scope
This policy covers vulnerabilities in the Akeru Bot source code, packaged applications, and Akeru Bot website. It does not authorize testing third-party providers, user devices, repositories, networks, or environments.
02
Reporting security issues
Use a private GitHub security advisory in the Akeru Bot repository. Include the affected version, impact, reproduction steps, and evidence with secrets removed. Do not publish the issue before maintainers have time to investigate it.
03
Shared responsibilities
Akeru Bot runs bots on systems you control. Keep the app and operating system up to date. Protect provider and repository credentials. Review commands and source changes before you approve them. Revoke any credential that may have leaked.
04
Contact
Use the Akeru Bot repository for security questions. This draft must receive qualified legal counsel review before any public release.