Skip to content

SECURITY.md

Latest commit

 

History

History
15 lines (8 loc) · 651 Bytes

SECURITY.md

File metadata and controls

15 lines (8 loc) · 651 Bytes

Security Policy

Reporting a vulnerability

If you discover a security vulnerability, please report it privately:

Email: security@openpencil.dev

Do not open a public issue. We'll acknowledge within 48 hours and aim to release a fix within 7 days for critical issues.

MCP server

The MCP HTTP transport (openpencil-mcp-http) binds to 127.0.0.1 by default with eval disabled, CORS disabled, and file access restricted to the working directory. See MCP docs for configuration.

The stdio transport (openpencil-mcp) is intended for local use only and does not apply these restrictions.