Security fixes are released for the latest 3.x version only. aiogram 2.x is no longer maintained.

Please do not report security vulnerabilities through public GitHub issues, discussions or chats.

Report them privately in one of these ways:

• GitHub private vulnerability reporting: https://github.com/aiogram/aiogram/security/advisories/new
• Email: jroot.junior@gmail.com

Please include the affected aiogram version, a description of the issue and its impact, and steps or code to reproduce it. A proposed fix is welcome but not required.

You will get a response as soon as possible. Once the issue is confirmed, a fix is prepared privately and released, and the advisory is published together with the release.

aiogram is enrolled in Anthropic OSS Scanner; its threat model lives in .oss-scanner/threat_model.md.