If you discover a security vulnerability in dokploy-mcp, please do not open a public issue.

Instead, email the maintainers directly. You should receive a response within 48 hours.

When reporting, include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Optionally: suggested fix

• dokploy-mcp uses x-api-key header authentication
• The API key is passed via the DOKPLOY_API_KEY environment variable
• Never log API keys — all logging redacts sensitive values
• Never commit API keys to version control

dokploy-mcp exposes mutating tools (create_application, update_application, assign_domain, trigger_deploy). These tools:

• Require explicit human approval before execution (via the MCP protocol)
• Should be scoped to specific project/application permissions in Dokploy
• Are not safe to expose to untrusted users without Dokploy API key protection

• Dokploy supports Docker-in-Docker (DinD) builds
• DinD builds require significant RAM/CPU — set explicit resource limits
• The recommend_build_strategy tool warns about resource-intensive builds

• Persistent volume data loss: always use ephemeral: false for persistent data
• Production misconfiguration: generateProductionRecommendations warns about common issues
• Secret exposure: mitigated by passing secrets via x-api-key header (never logged)
• Resource exhaustion: resource limits must be set explicitly

Run npm audit before each release to check for known vulnerabilities in dependencies.