# Getting help

> Where to ask, what to attach, what to redact before you paste it anywhere, and the private path for a security report.

Page: https://sdk.chatfuel.com/docs/troubleshooting/support
Markdown: https://sdk.chatfuel.com/docs/troubleshooting/support.md

Which place you want depends on what you have: a reproduction goes to Issues, a question goes to
Discussions or Discord, and anything security-shaped goes down a private path and never into either
of the others.

<Callout type="warn">
  Redact anything token-shaped before you paste it — a Chatfuel token, a Supabase key, a proxy URL
  with a password in it. **A token that reaches a public issue is a token to rotate**, and anything
  credential-shaped is treated as compromised whether or not anyone noticed. Rotating is [one
  command and a fresh token](/docs/guides/rotate-the-token); recovering a leaked one is not
  possible.
</Callout>

## Something is broken [#something-is-broken]

[Open an issue](https://github.com/chatfuel-lab/chatfuel-wizard/issues) and include the output of:

```bash
npx @chatfuel/wizard doctor
```

That's what a triage asks for first, and it answers most of what a bug report gets sent back for.

Before you write it, check whether the behaviour is already on [the symptom
list](/docs/troubleshooting), in [Limits that are not bugs](/docs/troubleshooting/limits), or in
[the error reference](/docs/reference/errors).

### What `doctor` reports [#what-doctor-reports]

It's the wizard's view of the machine before it asks anything, one row per check:

| Row                                                 | What it says                                                                            |
| --------------------------------------------------- | --------------------------------------------------------------------------------------- |
| `node`                                              | The Node running the wizard, and the floor it's compared against (20.18.1).             |
| `outbound proxy`                                    | The proxy variable in force and its URL with any password masked, or `none`.            |
| `coding agent`                                      | Which coding agents are installed, and the directory each reads skills from.            |
| `content`                                           | Whether the content tree is the packaged one or a repo checkout, and where its root is. |
| `app template`                                      | The app template's `package.json` is present.                                           |
| `ui sources`, `api-client sources`, `proxy sources` | The three packages the scaffold vendors are present.                                    |
| `module registry`                                   | How many modules are ready, out of how many manifests.                                  |
| `skill: <id>`                                       | One row per ready module, checking that its skill directory shipped.                    |

A missing coding agent is a warning — the wizard offers to install one. Everything else is a hard
stop, and the command exits 1. That's also why it exists in this shape: the same check is what
stops a tarball with an incomplete content tree from being published, instead of that surfacing ten
questions into somebody's first run.

Nothing it prints is a secret. Versions, paths, agent names, and a proxy URL with its password
replaced by `***`.

## You're not sure it's broken [#youre-not-sure-its-broken]

Ask in [Discussions](https://github.com/chatfuel-lab/chatfuel-wizard/discussions) or in
[Discord](https://discord.gg/TmrgcjVqFf). "How do I…", "is this supposed to…" and "has anyone…" all
belong there, and an answer usually arrives faster than a triage does.

A feature request is an issue too — or float it in Discussions first if it's more of a shape than a
request. Both get read.

## You found a vulnerability [#you-found-a-vulnerability]

Don't open an issue. Use GitHub's private vulnerability reporting on
[the repository](https://github.com/chatfuel-lab/chatfuel-wizard): the Security tab, "Report a
vulnerability". Only the latest 0.x release of `@chatfuel/wizard` gets security fixes.

Don't put a real Chatfuel token or Supabase key in the report either. Anything shaped like a
credential is treated as compromised — rotate it first.

The scope is the token boundary and the gate around it: the Chatfuel token and the Supabase
service-role key live server-side only and must never reach the browser bundle, a client-visible
response, or a log line, and the auth gate must fail closed rather than let a partial configuration
through. In scope:

* exposure of the Chatfuel token or a Supabase key anywhere in scaffolded output;
* a bypass of the auth gate, over HTTP or the WebSocket relay;
* secrets surviving the log scrubber;
* path traversal in the production static server.

Out of scope: your own modifications to your scaffolded app, and Chatfuel's hosted API itself.

## What this project does not support [#what-this-project-does-not-support]

The Chatfuel product. This is the open-source wizard and the app it writes; questions about the
hosted dashboard, billing, or the API's own behaviour go to Chatfuel support at
[chatfuel.com](https://chatfuel.com). A limit in the API is not a bug here — [Limits that are not
bugs](/docs/troubleshooting/limits) is the list of the ones that surface in the app.