If you discover a security vulnerability in Xeepy, please report it responsibly:

• ❌ Open a public GitHub issue
• ❌ Disclose the vulnerability publicly before it's fixed
• ❌ Exploit the vulnerability

• ✅ Email security concerns privately
• ✅ Provide detailed reproduction steps
• ✅ Allow time for us to address the issue

Please report security vulnerabilities to the repository owner via:

• GitHub: @nirholas (private message)
• Twitter: @nichxbt (DM)

1. Description of the vulnerability
2. Steps to reproduce
3. Potential impact
4. Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Fix deployment: Depends on severity

Security issues we care about:

• Session/cookie theft vulnerabilities
• Code injection possibilities
• Credential exposure risks
• Privilege escalation
• Data leakage

• Rate limiting bypass (intentionally not prevented in tool code)
• X/Twitter Terms of Service violations (user responsibility)
• Social engineering attacks

# DON'T commit session files
# Add to .gitignore:
session.json
cookies.json
*.session

# DON'T share your session
# Sessions contain authentication tokens

# DON'T hardcode API keys
# BAD:
ai = ContentGenerator(api_key="sk-abc123...")

# GOOD:
import os
ai = ContentGenerator(api_key=os.environ.get("OPENAI_API_KEY"))

# Create .env file (never commit!)
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...

# Add to .gitignore
.env
.env.local

# Verify package integrity
pip install xeepy --require-hashes

# Or check package checksums
pip hash xeepy

Xeepy is for educational purposes only. Users must:

1. Comply with X/Twitter Terms of Service
2. Respect rate limits
3. Not use for harassment or spam
4. Not scrape private/protected content without permission
5. Comply with applicable laws (GDPR, CCPA, etc.)

Thank you for helping keep Xeepy secure! 🛡️