16 lines
651 B
Markdown
16 lines
651 B
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
If you discover a security vulnerability, please report it privately:
|
|
|
|
**Email:** security@openpencil.dev
|
|
|
|
Do not open a public issue. We'll acknowledge within 48 hours and aim to release a fix within 7 days for critical issues.
|
|
|
|
## MCP server
|
|
|
|
The MCP HTTP transport (`openpencil-mcp-http`) binds to `127.0.0.1` by default with `eval` disabled, CORS disabled, and file access restricted to the working directory. See [MCP docs](https://openpencil.dev/reference/mcp-tools) for configuration.
|
|
|
|
The stdio transport (`openpencil-mcp`) is intended for local use only and does not apply these restrictions.
|