Skip to content

Commit b7a6c84

Browse files
datnguyedatnguye
committed
docs: add security policy document with guidelines for vulnerability reporting and best practices
1 parent 29aad95 commit b7a6c84

File tree

2 files changed

+160
-17
lines changed

2 files changed

+160
-17
lines changed

‎README.md‎

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ A Model Context Protocol (MCP) server that provides MetricFlow CLI tools through
2525
- [API Key Authentication](#api-key-authentication)
2626
- [Available Tools](#available-tools)
2727
- [Project Structure](#project-structure)
28-
- [Development](#development)
29-
- [Code Quality](#code-quality)
3028
- [Contributing ✨](#contributing-)
3129
- [TODO](#todo)
3230

@@ -186,27 +184,22 @@ src/
186184
└── main_stdio.py # STDIO server entry point
187185
```
188186

189-
## Development
190-
191-
### Code Quality
192-
193-
The project uses ruff for code formatting and linting:
187+
## Contributing ✨
194188

195-
```bash
196-
# Format code
197-
uv run ruff format
189+
If you've ever wanted to contribute to this tool, and a great cause, now is your chance!
198190

199-
# Check code quality
200-
uv run ruff check .
201-
```
191+
See the contributing docs [CONTRIBUTING](CONTRIBUTING.md) for more information.
202192

203-
## Contributing ✨
193+
If you've found this tool to be very helpful, please consider giving the repository a star, sharing it on social media, or even writing a blog post about it 💌
204194

205-
"If you've ever wanted to contribute to this tool, and a great cause, now is your chance!"
195+
[![mcp-metricflow stars](https://img.shields.io/github/stars/datnguye/mcp-metricflow.svg?logo=github&style=for-the-badge&label=Star%20this%20repo)](https://github.com/datnguye/mcp-metricflow)
196+
[![buy me a coffee](https://img.shields.io/badge/buy%20me%20a%20coffee-donate-yellow.svg?logo=buy-me-a-coffee&logoColor=white&labelColor=ff813f&style=for-the-badge)](https://www.buymeacoffee.com/datnguye)
206197

207-
See the contributing docs [CONTRIBUTING](CONTRIBUTING.md) for more information.
198+
Finally, super thanks to our *Contributors*:
208199

209-
"If you've found this tool to be very helpful, please consider giving the repository a star, sharing it on social media, or even writing a blog post about it 💌"
200+
<a href="https://github.com/datnguye/dbterd/graphs/contributors">
201+
<img src="https://contrib.rocks/image?repo=datnguye/dbterd" />
202+
</a>
210203

211204
## TODO
212205
- Test STDIO mode

‎SECURITY.md‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
# Security Policy
2+
3+
## Table of Contents
4+
5+
- [Security Policy](#security-policy)
6+
- [Table of Contents](#table-of-contents)
7+
- [Supported Versions](#supported-versions)
8+
- [Reporting a Vulnerability](#reporting-a-vulnerability)
9+
- [1. Do NOT create a public issue](#1-do-not-create-a-public-issue)
10+
- [2. Report privately](#2-report-privately)
11+
- [3. Include detailed information](#3-include-detailed-information)
12+
- [4. Response timeline](#4-response-timeline)
13+
- [Security Best Practices](#security-best-practices)
14+
- [API Key Security](#api-key-security)
15+
- [Environment Configuration](#environment-configuration)
16+
- [Network Security](#network-security)
17+
- [Data Protection](#data-protection)
18+
- [Known Security Considerations](#known-security-considerations)
19+
- [SSE Server](#sse-server)
20+
- [MetricFlow Integration](#metricflow-integration)
21+
- [Dependencies](#dependencies)
22+
- [Security Updates](#security-updates)
23+
- [How we handle security updates](#how-we-handle-security-updates)
24+
- [Staying informed](#staying-informed)
25+
- [Responsible Disclosure](#responsible-disclosure)
26+
- [Hall of Fame](#hall-of-fame)
27+
28+
## Supported Versions
29+
30+
We actively support security updates for the following versions of `mcp-metricflow`:
31+
32+
| Version | Supported |
33+
| ------- | ------------------ |
34+
| Latest | :white_check_mark: |
35+
| < Latest| :x: |
36+
37+
We recommend always using the latest version to ensure you have the most recent security updates.
38+
39+
## Reporting a Vulnerability
40+
41+
We take security vulnerabilities seriously. If you discover a security vulnerability, please follow these steps:
42+
43+
### 1. Do NOT create a public issue
44+
45+
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
46+
47+
### 2. Report privately
48+
49+
Instead, please report the vulnerability by:
50+
51+
- **Email**: Send details to [[email protected]](mailto:[email protected])
52+
- **Subject Line**: Include "SECURITY VULNERABILITY - mcp-metricflow" in the subject
53+
- **GitHub Security Advisories**: Use GitHub's private vulnerability reporting feature (preferred)
54+
55+
### 3. Include detailed information
56+
57+
Please include as much information as possible:
58+
59+
- Type of vulnerability (e.g., authentication bypass, code injection, etc.)
60+
- Step-by-step instructions to reproduce the issue
61+
- Potential impact and attack scenarios
62+
- Any suggested fixes or mitigations
63+
- Your contact information for follow-up questions
64+
65+
### 4. Response timeline
66+
67+
We will acknowledge receipt of your vulnerability report within **48 hours** and provide a more detailed response within **7 days** indicating the next steps in handling your report.
68+
69+
## Security Best Practices
70+
71+
When using `mcp-metricflow`, please follow these security best practices:
72+
73+
### API Key Security
74+
- **Never commit API keys** to version control
75+
- **Use environment variables** for sensitive configuration
76+
- **Rotate API keys regularly**
77+
- **Use strong, unique API keys** for production environments
78+
- **Limit API key permissions** to the minimum required scope
79+
80+
### Environment Configuration
81+
- **Secure your `.env` files** and never commit them to version control
82+
- **Use different API keys** for development, staging, and production
83+
- **Implement proper access controls** for your dbt projects and data warehouse
84+
- **Regularly audit your environment variables** and remove unused keys
85+
86+
### Network Security
87+
- **Use HTTPS** for all SSE server communications
88+
- **Implement proper firewall rules** when exposing the SSE server
89+
- **Consider using a reverse proxy** with additional security features
90+
- **Monitor server logs** for suspicious activity
91+
92+
### Data Protection
93+
- **Validate all inputs** to MetricFlow commands
94+
- **Implement proper authentication** for SSE mode when required
95+
- **Use least privilege principles** for database connections
96+
- **Regular security audits** of your dbt project permissions
97+
98+
## Known Security Considerations
99+
100+
### SSE Server
101+
- The SSE server can be run with or without authentication
102+
- When `MCP_REQUIRE_AUTH=false`, the server accepts all connections
103+
- API keys are transmitted in HTTP headers - ensure HTTPS is used
104+
- The `/health` endpoint is always accessible without authentication
105+
106+
### MetricFlow Integration
107+
- Commands are executed with the permissions of the running user
108+
- Database credentials are inherited from dbt profiles
109+
- Query results may contain sensitive business data
110+
111+
### Dependencies
112+
- Regular dependency updates are performed to address security vulnerabilities
113+
- We use `bandit` for static security analysis
114+
- Pre-commit hooks help prevent common security issues
115+
116+
## Security Updates
117+
118+
### How we handle security updates
119+
120+
1. **Assessment**: We evaluate the severity and impact of reported vulnerabilities
121+
2. **Development**: We develop and test fixes in private repositories
122+
3. **Coordination**: For significant vulnerabilities, we may coordinate with other projects
123+
4. **Release**: We release security updates as quickly as possible
124+
5. **Disclosure**: We publish security advisories after fixes are available
125+
126+
### Staying informed
127+
128+
- **Watch this repository** to receive notifications about security updates
129+
- **Check releases regularly** for security-related updates
130+
- **Subscribe to our security advisories** through GitHub
131+
132+
## Responsible Disclosure
133+
134+
We follow responsible disclosure practices:
135+
136+
- **Coordination**: We work with security researchers to understand and fix vulnerabilities
137+
- **Timeline**: We aim to fix critical vulnerabilities within 30 days
138+
- **Credit**: We provide appropriate credit to security researchers (with their permission)
139+
- **Transparency**: We publish security advisories for significant vulnerabilities
140+
141+
### Hall of Fame
142+
143+
We thank the following security researchers for their responsible disclosure:
144+
145+
<!-- This section will be updated as we receive security reports -->
146+
*No security vulnerabilities have been reported yet.*
147+
148+
---
149+
150+
Thank you for helping keep `mcp-metricflow` and the community safe!

0 commit comments

Comments
 (0)