Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
latest	Yes

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

Do not open a public issue
Email: [security contact via GitHub]
Include: description, reproduction steps, and impact assessment

Scope

In Scope

Command injection via tool arguments
API key exposure or leakage
Unauthorized Stripe API access beyond declared tool capabilities
Path traversal in file operations

Out of Scope

Third-party dependency vulnerabilities (report upstream)
Denial of service attacks
Issues requiring physical access

There aren't any published security advisories