{
- const p = await fetch(a);
- return p;
-}
-```
-
----
-
-## π Documentation
-
-### Documentation Standards
-
-- Keep documentation clear and concise
-- Use examples wherever possible
-- Update documentation when changing functionality
-- Follow the existing documentation structure
-
-### Documentation Files
-
-- `README.md` β Main project overview and quick start
-- `docs/*.md` β Detailed guides for specific topics
-- Code comments β Inline documentation for complex logic
-
-### Writing Style
-
-- Use clear, simple language
-- Break complex topics into steps
-- Include code examples
-- Add visual aids (screenshots, diagrams) when helpful
-- Use emojis sparingly for visual navigation
-
----
-
-## π§ͺ Testing
-
-Currently, this project doesn't have a formal test suite. If you'd like to contribute tests:
-
-- Use a testing framework (Jest, Mocha, etc.)
-- Write unit tests for utility functions
-- Consider integration tests for critical flows
-- Document how to run tests
-
----
-
-## π Debugging
-
-When debugging issues:
-
-1. Enable diagnostics in `config.jsonc`:
- ```jsonc
- {
- "diagnostics": {
- "enabled": true,
- "saveScreenshot": true,
- "saveHtml": true
- }
- }
- ```
-
-2. Check logs in the console and `reports/` folder
-
-3. Use VS Code debugger with launch configuration
-
----
-
-## π¬ Getting Help
-
-- **Discord:** [Join our community](https://discord.gg/k5uHkx9mne)
-- **GitHub Issues:** Ask questions or report problems
-- **Documentation:** Check the [docs folder](docs/index.md)
-
----
-
-## π― Contribution Ideas
-
-Not sure where to start? Here are some ideas:
-
-### Beginner-Friendly
-
-- Fix typos in documentation
-- Improve error messages
-- Add code comments
-- Create examples or tutorials
-
-### Intermediate
-
-- Refactor complex functions
-- Improve error handling
-- Add new configuration options
-- Optimize performance
-
-### Advanced
-
-- Implement new activity types
-- Enhance anti-detection mechanisms
-- Add comprehensive testing
-- Improve Docker deployment
-
----
-
-## π Recognition
-
-Contributors will be:
-- Listed in the project's contributors page
-- Mentioned in release notes (for significant contributions)
-- Appreciated by the community! π
-
----
-
-## π License
-
----
-
-## π License
-
-By contributing, you agree that your contributions will be licensed under the same [Non-Commercial Personal Use License](LICENSE) as the project.
-
----
-
----
-
-
-
-**Thank you for contributing!** π
-
-[Back to README](README.md) β’ [Documentation](docs/index.md) β’ [Discord](https://discord.gg/k5uHkx9mne)
-
-
diff --git a/NOTICE b/NOTICE
deleted file mode 100644
index f90604a..0000000
--- a/NOTICE
+++ /dev/null
@@ -1,49 +0,0 @@
-Microsoft Rewards Bot
-Copyright (c) 2025 Obsidian-wtf
-
-This project is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0
-International License. See LICENSE file for details.
-
-================================================================================
-
-IMPORTANT LEGAL NOTICES
-
-π¨ USE AT YOUR OWN RISK
-
-This software automates interactions with Microsoft Rewards, which may violate
-Microsoft's Terms of Service. Potential consequences include:
-
- β’ Account suspension or permanent ban
- β’ Loss of accumulated points and rewards
- β’ Restriction from Microsoft services
-
-The authors and contributors:
- β’ Are NOT responsible for any actions taken by Microsoft
- β’ Do NOT encourage violating terms of service
- β’ Provide this for EDUCATIONAL purposes only
-
-================================================================================
-
-THIRD-PARTY SOFTWARE
-
-This project uses open-source libraries:
- β’ Playwright (Apache-2.0)
- β’ ReBrowser-Playwright (Apache-2.0)
- β’ Cheerio (MIT)
- β’ Axios (MIT)
- β’ And others (see package.json)
-
-All trademarks and service marks are the property of their respective owners.
-
-================================================================================
-
-PRIVACY & DATA
-
-This software stores credentials locally only. No data is sent to third parties
-except as required for Microsoft Rewards functionality. You are responsible for
-securing your configuration files.
-
-================================================================================
-
-For issues, questions, or contributions:
-https://github.com/Obsidian-wtf/Microsoft-Rewards-Bot
diff --git a/README.md b/README.md
index 3be9c11..b940170 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
[](https://discord.gg/k5uHkx9mne)
[](https://github.com/Obsidian-wtf/Microsoft-Rewards-Bot)
-[](https://github.com/Obsidian-wtf/Microsoft-Rewards-Bot/releases)
+[](https://github.com/Obsidian-wtf/Microsoft-Rewards-Bot/releases)
[](LICENSE)
diff --git a/SECURITY.md b/SECURITY.md
deleted file mode 100644
index c0a338d..0000000
--- a/SECURITY.md
+++ /dev/null
@@ -1,368 +0,0 @@
-# π Security & Privacy Policy# Security & Privacy Guidelines# Security & Privacy Policy
-
-
-
-
-
-
-
-**Your data, your control β transparency first**This document describes how the Microsoft Rewards Script V2 handles data, the assumptions we make about your environment, and how to report security concerns. The codebase runs entirely under your control; there is no built-in telemetry or remote service component.Hi there! π Thanks for caring about security and privacy β we do too. This document explains how this project approaches data handling, security practices, and how to report issues responsibly.
-
-
-
-This document explains how the Microsoft Rewards Script handles your information,
-
-what we do (and don't do) with it, and how to keep your setup secure.
-
----## TL;DR
-
-
-
-
-
----
-
-## Data Flow Summary- We do not collect, phone-home, or exfiltrate your data. No hidden telemetry. π«π‘
-
-## π― TL;DR β The Quick Version
-
-- Your credentials stay on your machine (or in your container volumes). π
-
-| Topic | What You Need to Know |
-
-|:------|:----------------------|- Configuration is loaded from local files (`src/config.jsonc`, `src/accounts.json`) or environment variables you supply.- Sessions/cookies are stored locally to reduce re-login friction. πͺ
-
-| **π‘ Data Collection** | β **None** β No telemetry, no phone-home, no tracking |
-
-| **π Credentials** | β
Stored **locally only** in `src/accounts.json` or environment variables |- The automation layer drives Playwright browsers to interact with Microsoft Rewards. No other network destinations are contacted unless you configure outbound notifications.- Use at your own risk. Microsoft may take action on accounts that use automation.
-
-| **πͺ Sessions** | β
Saved **on your machine** to avoid repeated logins |
-
-| **π Webhooks** | β οΈ Optional β **You control** what gets sent where |- Diagnosed artifacts (logs, screenshots, HTML snapshots) are written to local folders within the repository.
-
-| **π³ Docker** | β
Read-only mounts, no data leaves the container |
-
-| **βοΈ Terms of Service** | β οΈ Automation **may violate** Microsoft's ToS β use at your own risk |## What this project does (and doesnβt)
-
-
-
----We do not collect or transmit your credentials, points totals, or activity history. All state remains on the host executing the script.
-
-
-
-## π What This Script DoesThis is a local automation tool that drives a browser (Playwright) to perform Microsoft Rewards activities. By default:
-
-
-
-This is a **local automation tool** that drives a browser (Playwright) to complete Microsoft Rewards activities on your behalf.---
-
-
-
-### β
What it does:- It reads configuration from local files (e.g., `src/config.jsonc`, `src/accounts.json`).
-
-- Reads configuration from local files (`src/config.jsonc`, `src/accounts.json`)
-
-- Stores session data (cookies, fingerprints) locally under `src/browser/`## Stored Data- It can save session data (cookies and optional fingerprints) locally under `./src/browser///`.
-
-- Optionally sends notifications to endpoints **you configure**
-
-- Saves diagnostic logs and screenshots to `reports/` when troubleshooting- It can send optional notifications/webhooks if you enable them and provide a URL.
-
-
-
-### β What it does NOT do:| Item | Location | Notes |
-
-- Collect or transmit your data to any third-party service by default
-
-- Include any hidden telemetry or analytics|------|----------|-------|It does not:
-
-- Store credentials anywhere except where you specify
-
-- Run background processes you don't know about| Account credentials | `src/accounts.json` or environment variables | Keep this file out of source control. Use `.gitignore` and restrict file permissions. |
-
-
-
----| Configuration | `src/config.jsonc` | Comment-friendly JSONC; may contain secrets (webhook URLs, proxies). |- Send your accounts or secrets to any third-party service by default.
-
-
-
-## π¦ Where Your Data Lives| Sessions & fingerprints | `src/browser//` | Contains cookies and optional device fingerprints used for continuity. Safe to delete if you want fresh sessions. |- Embed any βphone-homeβ or analytics endpoints.
-
-
-
-| Data Type | Location | Purpose | Security Notes || Diagnostics | `reports/` (when enabled) | Screenshots, HTML, and logs captured for debugging. Review before sharing. |- Include built-in monetization, miners, or adware. π«π
-
-|:----------|:---------|:--------|:--------------|
-
-| **π Credentials** | `src/accounts.json` or env vars | Login automation | **Keep out of Git!** Add to `.gitignore` |
-
-| **βοΈ Configuration** | `src/config.jsonc` | Runtime settings | May contain webhook URLs β treat as sensitive |
-
-| **πͺ Sessions** | `src/browser//` | Persist logins | Cookies + fingerprints β delete to reset |When running inside Docker, the compose file mounts `./src/accounts.json`, `./src/config.jsonc`, and `./sessions` as read-only or persistent volumes. No data leaves those mounts unless you explicitly configure additional outputs.## Data handling and storage
-
-| **π Reports** | `reports/` folder | Diagnostics | Screenshots/logs β review before sharing |
-
-| **π³ Docker volumes** | Container mounts | Same as above | Read-only where possible |
-
-
-
-------- Accounts: You control the `accounts.json` file. Keep it safe. Consider environment variables or secrets managers in CI/CD.
-
-
-
-## π Keeping Your Setup Secure- Sessions: Cookies are stored locally to speed up login. You can delete them anytime by removing the session folder.
-
-
-
-### 1οΈβ£ **Protect Your Credentials**## Credentials & Secrets- Fingerprints: If you enable fingerprint saving, they are saved locally only. Disable this feature if you prefer ephemeral fingerprints.
-
-
-
-```bash- Logs/Reports: Diagnostic artifacts and daily summaries are written to the local `reports/` directory.
-
-# β
DO: Keep accounts.json out of version control
-
-echo "src/accounts.json" >> .gitignore- Do not commit `src/accounts.json` or any file containing secrets. The sample `.gitignore` already excludes them; verify your local overrides do the same.- Webhooks/Notifications: If enabled, we send only the minimal information necessary (e.g., summary text, embed fields) to the endpoint you configured.
-
-
-
-# β
DO: Use environment variables in CI/CD- If you use TOTP, the Base32 secret remains local and is only used to respond to Microsoft login challenges.
-
-export ACCOUNTS_JSON='[{"email":"...","password":"..."}]'
-
-- For CI or scripted deployments, prefer supplying credentials through environment variables (`ACCOUNTS_JSON` or `ACCOUNTS_FILE`).Tip: For Docker, mount a dedicated data volume for sessions and reports so you can manage them easily. π¦
-
-# β DON'T: Commit secrets to GitHub
-
-# β DON'T: Share accounts.json publicly- Rotate your Microsoft account passwords and webhook tokens periodically.
-
-```
-
-## Credentials and secrets
-
-### 2οΈβ£ **Secure Your Configuration**
-
----
-
-- **Webhook URLs** in `config.jsonc` are essentially passwords β anyone with the URL can post to your channel
-
-- **TOTP secrets** stay local and are only used during Microsoft login challenges- Do not commit secrets. Use `src/accounts.json` locally or set `ACCOUNTS_JSON`/`ACCOUNTS_FILE` via environment variables when running in containers.
-
-- **Proxy credentials** should be treated like passwords
-
-## Notifications- Consider using OS keychains or external secret managers where possible.
-
-### 3οΈβ£ **Session Management**
-
-- TOTP: If you include a Base32 TOTP secret per account, it remains local and is used strictly during login challenge flows.
-
-```bash
-
-# Clear sessions if you suspect compromiseOptional integrations (Discord webhooks, NTFY, others you add) send only the payloads you configure. Review each providerβs privacy policy before enabling. Treat webhook URLs as shared secrets; they allow anyone with the URL to post into the channel.
-
-rm -rf src/browser/sessions/*
-
-## Buy Mode safety
-
-# Or in Docker
-
-docker compose down -v # Removes volumes---
-
-```
-
-Buy Mode opens a monitor tab (read-only points polling) and a separate user tab for your manual actions. The monitor tab doesnβt redeem or click on your behalf β it just reads dashboard data to keep totals up to date. ποΈ
-
-### 4οΈβ£ **Docker Best Practices**
-
-## Recommended Practices
-
-The included `compose.yaml` already:
-
-- β
Uses read-only mounts for config files## Responsible disclosure
-
-- β
Runs as non-root user where possible
-
-- β
Limits container privileges- Run the script with least privilege. When using Docker, the provided compose file uses non-root execution and read-only mounts where possible.
-
-
-
-Additional hardening:- Back up `sessions` only if you understand the contents (cookies, fingerprints). Delete the directory if you suspect compromise or want to reset state.We value coordinated disclosure. If you find a security issue:
-
-```yaml
-
-security_opt:- Enable the diagnostics bundle (`docs/diagnostics.md`) only when troubleshooting, and scrub artifacts before sharing.
-
- - no-new-privileges:true
-
-cap_drop:- Keep dependencies updated (`npm run build` after `npm install`) to receive security patches for Playwright and transitive packages.1. Please report it privately first via an issue marked βSecurityβ with a note to request contact details, or by contacting the repository owner directly if available.
-
- - ALL
-
-```- Review `src/config.jsonc` comments; several fields (e.g., `humanization`, `retryPolicy`) influence how aggressively the automation behaves. Conservative defaults reduce the chance of account flags.2. Provide a minimal reproduction and version info.
-
-
-
-### 5οΈβ£ **Regular Maintenance**3. We will acknowledge within a reasonable timeframe and work on a fix. π
-
-
-
-- π **Update dependencies:** `npm install && npm run build`---
-
-- π **Rotate credentials** periodically
-
-- π§Ή **Clean diagnostics:** Review and delete `reports/` contentsPlease do not open public issues with sensitive details before we have had a chance to remediate.
-
-- π **Monitor logs** for suspicious activity
-
-## Responsible Disclosure
-
----
-
-## Scope and assumptions
-
-## π Notifications & Privacy
-
-If you discover a vulnerability in this project:
-
-When you enable Discord webhooks or NTFY:
-
-- The script sends **only the summary data you configure**- This project is open-source and runs on your infrastructure (local machine or container). You are responsible for host hardening and network policies.
-
-- No credentials or session data is included
-
-- The receiving service (Discord, NTFY, etc.) has its own privacy policy1. Privately reach out via a GitHub issue tagged βSecurityβ requesting a direct contact channel, or message a maintainer through the listed GitHub profile if available.- Automation can violate terms of service. You assume all responsibility for how you use this tool.
-
-
-
-**Control what gets sent:**2. Include a minimal reproduction, environment details, and the commit or release you tested.- Browsers and dependencies evolve. Keep the project and your runtime up to date.
-
-```jsonc
-
-// In config.jsonc3. Allow a reasonable window for investigation and remediation before publishing details.
-
-"notifications": {
-
- "conclusionWebhook": {## Dependency and update policy
-
- "enabled": false, // Disable to send nothing
-
- "url": "https://discord.com/api/webhooks/..."We appreciate coordinated disclosure and will credit contributions in the changelog when permitted.
-
- }
-
-}- We pin key dependencies where practical and avoid risky postinstall scripts in production builds.
-
-```
-
----- Periodic updates are encouraged. The project includes an optional auto-update helper. Review changes before enabling in sensitive environments.
-
----
-
-- Use Playwright official images when running in containers to receive timely browser security updates. π‘οΈ
-
-## π‘οΈ Responsible Use Guidelines
-
-## Scope & Assumptions
-
-### β
**Good Practices**
-
-- Run with least privileges (avoid root/admin unless needed)## Safe use guidelines
-
-- Use environment variables for secrets in production
-
-- Keep the repository and dependencies updated- The project runs on infrastructure you control. Host hardening, firewall rules, and secret storage are your responsibility.
-
-- Review code changes before pulling updates
-
-- Monitor account health regularly- Automation may violate Microsoftβs terms of service. Use at your own risk; the maintainers are not liable for account actions Microsoft may take.- Run with least privileges. In Docker, prefer non-root where feasible and set `no-new-privileges` if supported.
-
-
-
-### β οΈ **Risk Awareness**- Playwright and Chromium evolve quickly. Rebuild after dependency updates and monitor upstream advisories.- Limit outbound network access if your threat model requires it.
-
-- **Microsoft ToS:** Automation violates their terms β accounts may be suspended
-
-- **Rate limiting:** Aggressive settings increase ban risk- Rotate credentials periodically and revoke unused secrets.
-
-- **Shared environments:** Don't run on untrusted machines
-
-- **Network exposure:** Limit outbound connections if your threat model requires it---- Clean up diagnostics and reports if they contain sensitive metadata.
-
-
-
----
-
-
-
-## π Vulnerability Reporting## Contact## Privacy statement
-
-
-
-We value security research and coordinated disclosure.
-
-
-
-### π§ **How to Report**Open a GitHub issue labeled βSecurityβ or reach out to the repository owner if you require a private communication channel. Provide as much diagnostic context as you can share safely.We donβt collect personal data. The repository does not embed analytics. Any processing done by this tool happens locally or against the Microsoft endpoints it drives on your behalf.
-
-
-
-1. **Privately open a GitHub issue** labeled "Security"
-
-2. **Include:**
-
- - Description of the vulnerabilityStay safe, and automate responsibly.If you enable third-party notifications (Discord, NTFY, etc.), data sent there is under your control and subject to those servicesβ privacy policies.
-
- - Steps to reproduce
-
- - Affected versions/commits
-
- - Suggested remediation (if any)## Contact
-
-3. **Give us time** to investigate and patch before public disclosure
-
-To report a security issue or ask a question, please open an issue with the βSecurityβ label and weβll follow up with a private channel. You can also reach out to the project owner/maintainers via GitHub if contact details are listed. π¬
-
-### π **Recognition**
-
-Security contributors will be credited in the changelog (with permission).β Stay safe and have fun automating! β¨
-
-
----
-
-## π Security Checklist
-
-
-π Click to expand the complete security checklist
-
-- [ ] `src/accounts.json` is in `.gitignore`
-- [ ] File permissions restrict access to sensitive configs
-- [ ] Using TOTP for 2FA (reduces password-only exposure)
-- [ ] Webhook URLs treated as secrets
-- [ ] Sessions folder backed up securely (if at all)
-- [ ] Running with minimal privileges
-- [ ] Docker using read-only mounts where possible
-- [ ] Dependencies updated regularly
-- [ ] Diagnostic reports reviewed before sharing
-- [ ] Monitoring for unusual account activity
-
-
-
----
-
-## π Contact
-
-- **Security issues:** Open a GitHub issue with "Security" label
-- **General support:** [Discord community](https://discord.gg/k5uHkx9mne)
-- **Bug reports:** [GitHub Issues](https://github.com/Obsidian-wtf/Microsoft-Rewards-Bot/issues)
-
----
-
-
-
-**Stay safe, automate responsibly** β¨
-
----
-
-*Last updated: 2025*
-
-
-
-**Thank you for considering contributing to this project!**
-
-