Write to contact@nerdresolve.com. Don't open a public issue for a security flaw: the issue is visible to everyone before a fix exists.

Tell us what you can about what happened, how to reproduce it and what the impact is. We get back to you within 5 business days.

This repository contains no credentials at all, and npm run check fails the build if anyone commits one. Anything secret lives in .env, which .gitignore ignores; .env.example carries only the variable names, all empty.

If you exposed a token by mistake:

1. Revoke it first. In the Discord Developer Portal → Bot → Reset Token. While the token lives, whoever has it controls the bot; removing the commit isn't enough, because GitHub keeps the object and bots sweep public commits within seconds.
2. Then clean the history (git filter-repo) and force push.

The bot asks for the minimum permissions needed to play audio and answer commands. If you find something that requires a permission beyond that, it's a bug — tell us.