This is an early community-maintained release. No response-time or long-term support SLA is promised. Report against the current source and include the host/plugin versions and affected trust boundary.

Do not publish real bot secrets, tokens, OpenIDs, private conversations or profile exports. Revoke exposed credentials immediately at the QQ provider and rotate the owning profile's stored secrets.

Use this repository's GitHub Security → Report a vulnerability private reporting flow for suspected authorization bypass, cross-profile leaks or other exploitable issues. Do not open a public exploit issue. If private reporting is unavailable, contact the maintainer privately through a contact method they explicitly publish before sharing sensitive details.

Include minimal redacted reproduction steps, expected versus observed behavior and impact. Avoid unsolicited live messages, menu writes or testing on other users' bots.

Non-sensitive compatibility/setup bugs may be filed as ordinary issues with redacted logs. QQ platform policy and account-access questions belong with QQ Open Platform; this plugin cannot grant platform permissions.