Getting help
Where to ask, what to attach, what to redact before you paste it anywhere, and the private path for a security report.
Which place you want depends on what you have: a reproduction goes to Issues, a question goes to Discussions or Discord, and anything security-shaped goes down a private path and never into either of the others.
Redact anything token-shaped before you paste it — a Chatfuel token, a Supabase key, a proxy URL with a password in it. A token that reaches a public issue is a token to rotate, and anything credential-shaped is treated as compromised whether or not anyone noticed. Rotating is one command and a fresh token; recovering a leaked one is not possible.
Something is broken
Open an issue and include the output of:
npx @chatfuel/wizard doctorThat's what a triage asks for first, and it answers most of what a bug report gets sent back for.
Before you write it, check whether the behaviour is already on the symptom list, in Limits that are not bugs, or in the error reference.
What doctor reports
It's the wizard's view of the machine before it asks anything, one row per check:
| Row | What it says |
|---|---|
node | The Node running the wizard, and the floor it's compared against (20.18.1). |
outbound proxy | The proxy variable in force and its URL with any password masked, or none. |
coding agent | Which coding agents are installed, and the directory each reads skills from. |
content | Whether the content tree is the packaged one or a repo checkout, and where its root is. |
app template | The app template's package.json is present. |
ui sources, api-client sources, proxy sources | The three packages the scaffold vendors are present. |
module registry | How many modules are ready, out of how many manifests. |
skill: <id> | One row per ready module, checking that its skill directory shipped. |
A missing coding agent is a warning — the wizard offers to install one. Everything else is a hard stop, and the command exits 1. That's also why it exists in this shape: the same check is what stops a tarball with an incomplete content tree from being published, instead of that surfacing ten questions into somebody's first run.
Nothing it prints is a secret. Versions, paths, agent names, and a proxy URL with its password
replaced by ***.
You're not sure it's broken
Ask in Discussions or in Discord. "How do I…", "is this supposed to…" and "has anyone…" all belong there, and an answer usually arrives faster than a triage does.
A feature request is an issue too — or float it in Discussions first if it's more of a shape than a request. Both get read.
You found a vulnerability
Don't open an issue. Use GitHub's private vulnerability reporting on
the repository: the Security tab, "Report a
vulnerability". Only the latest 0.x release of @chatfuel/wizard gets security fixes.
Don't put a real Chatfuel token or Supabase key in the report either. Anything shaped like a credential is treated as compromised — rotate it first.
The scope is the token boundary and the gate around it: the Chatfuel token and the Supabase service-role key live server-side only and must never reach the browser bundle, a client-visible response, or a log line, and the auth gate must fail closed rather than let a partial configuration through. In scope:
- exposure of the Chatfuel token or a Supabase key anywhere in scaffolded output;
- a bypass of the auth gate, over HTTP or the WebSocket relay;
- secrets surviving the log scrubber;
- path traversal in the production static server.
Out of scope: your own modifications to your scaffolded app, and Chatfuel's hosted API itself.
What this project does not support
The Chatfuel product. This is the open-source wizard and the app it writes; questions about the hosted dashboard, billing, or the API's own behaviour go to Chatfuel support at chatfuel.com. A limit in the API is not a bug here — Limits that are not bugs is the list of the ones that surface in the app.