AutomatorBot's source isn't published in this repository, but that doesn't mean issues can't exist in the live bot, dashboard, or database layer. If you've found something, please report it responsibly.

• Being able to see, modify, pause, resume, or delete another user's monitored URLs
• Being able to access the web dashboard without a valid personal access key
• Any way to bypass the Turnstile check on the dashboard login at scale
• Leaked or guessable access keys
• Anything that lets you read another user's data through the bot's commands

• Rate-limit / abuse reports for the public test target (PulseCheck) — that's a throwaway demo service, not part of AutomatorBot itself
• Missing features, UX suggestions, or translation improvements — please use CONTRIBUTING.md for those instead

Please do not open a public GitHub issue for a security report. Instead, message the bot's maintainer directly on Telegram with:

1. A clear description of the issue
2. Steps to reproduce it (screenshots/screen recordings help)
3. What you'd expect to happen instead

I'll acknowledge reports as quickly as I can and keep you updated as it's investigated and fixed. Credit is happily given if you'd like it.