Generated projects are independent copies. Maintainers must apply Volt-Base security releases and dependency updates to those copies; publishing a generator fix cannot update an existing bot.

Do not open a public issue or include credentials in a report. Use the repository's private vulnerability reporting. Include affected versions, impact, a minimal reproduction, and suggested mitigation if known. Never send a live Discord token; use a clearly fake placeholder.

We target acknowledgement within two business days. Target mitigation windows begin when impact is confirmed: 48 hours for critical, 7 days for high, 30 days for moderate, and 90 days for low severity. Actual disclosure is coordinated with the reporter and downstream maintainers.

CI blocks unaccepted high/critical advisories. A temporary exception requires a private risk record with advisory ID, affected path, exploitability, compensating control, owner, expiry (maximum 30 days), and removal trigger. The Security workflow must use a specific advisory ignore, never a broad disabled audit. Expired exceptions block release.

The current undici@6.27.0 override compensates for Discord.js 14.26.4 pinning an affected 6.24.1 release. It stays until Discord.js and @discordjs/rest directly require a non-vulnerable compatible version; dependency-update PRs must run the runtime/REST/WebSocket smoke suite before removing it.

If a token may have leaked, revoke and rotate it immediately in the Discord Developer Portal before investigating source control or logs. See incident response.