This security policy applies to the dicechess-bot-java reference house bot service and starter template. The Dice Chess rules engine and the core platform API/services are governed by the security policies of their respective repositories:

• dicechess-engine
• dicechess-play-api

Please do not report security vulnerabilities through public GitHub issues or public pull requests.

Instead, please use the GitHub Private Vulnerability Reporting feature:

1. On GitHub, navigate to the main page of the repository (fortemate/dicechess-bot-java).
2. Under the repository name, click Security.
3. In the left sidebar, click Advisories.
4. Click Report a vulnerability.

Alternatively, you can contact the maintainer directly at security@fortemate.com.

As a solo-maintained open-source project, we will acknowledge your report within 48 hours and coordinate a fix and release disclosure timeline with you.