🔒 Security Policy

Keeping Soundy and our community safe

We take security seriously. If you discover a security vulnerability in Soundy, please help us protect our users by reporting it responsibly.

When reporting a security issue, please provide:

• 📝 Detailed description of the vulnerability
• 🔧 Steps to reproduce the issue
• 💥 Potential impact assessment
• 🛠️ Suggested fix (if any)
• 📱 Environment details (OS, Node.js version, etc.)

⚠️ Important: Please do NOT disclose security issues publicly until they have been reviewed and resolved.

We provide security updates for the following versions of Soundy:

• 🔄 Automatic Updates: Recommended for security patches
• 📦 Manual Updates: Check releases regularly
• 🚨 Critical Updates: Immediate notification via Discord

💡 Tip: Always use the latest version for the best security and features.

We appreciate security researchers who help keep Soundy safe. Our commitment to you:

✅ In Scope:

• Authentication and authorization issues
• Data validation and injection vulnerabilities
• Privilege escalation
• Information disclosure
• Denial of service attacks

❌ Out of Scope:

• Social engineering attacks
• Physical security issues
• Third-party service vulnerabilities
• Rate limiting (unless severe)

For bot administrators and users:

• Never share your bot token publicly
• Use environment variables for sensitive data
• Rotate tokens regularly
• Monitor for unauthorized access

• Keep dependencies updated
• Use secure hosting environments
• Enable logging and monitoring
• Regular security audits

• Report suspicious activity
• Keep software updated
• Follow principle of least privilege
• Educate team members on security