If you discover a security vulnerability in this project, please report it responsibly:

1. Do NOT open a public GitHub issue for security vulnerabilities.
2. Email: Send details to the repository owner via GitHub private messaging or through the Security Advisories tab.
3. Include: A description of the vulnerability, steps to reproduce, and potential impact.

You can expect an initial response within 72 hours.

This project implements the following security hardening:

• No hardcoded credentials — All API keys, passwords, and IPs loaded from environment variables or AWS SSM
• Whitelist enforcement — Minecraft server restricts access to pre-authorized accounts only
• Port obscurity — Non-default external port with AWS Security Group restrictions
• Prototype pollution protection — Recursive sanitization of all external config input
• Input validation — Command injection detection, type checking, control character stripping
• Rate limiting — Per-user rate limiting with automatic stale-entry cleanup
• Path traversal guards — Cross-platform validation on all file path inputs
• Code sandboxing — SES (Secure ECMAScript) sandbox for user-generated code execution
• ESLint hardening — Zero-warning tolerance enforced pre-commit via Husky
• Docker isolation — Bot runs as non-root node user; secrets excluded from build context

The following files contain secrets and must never be committed:

• Set MINECRAFT_PORT in .env to configure your external Minecraft port (defaults to 42069)
• Set EC2_PUBLIC_IP in .env for deployment scripts to reference your server IP
• All LLM API keys should be set via environment variables (see .env.example)