| Version | Supported |
|---|---|
| 1.x | Yes |
If you discover a security vulnerability in this project, please report it responsibly. Do not open a public GitHub issue.
- Email: security@securitymcp.io
- Response Time: We aim to acknowledge reports within 48 hours and provide a fix or mitigation plan within 7 business days.
- Description of the vulnerability
- Steps to reproduce
- Potential impact assessment
- Suggested fix (if any)
- Report the vulnerability via the contact above
- We will acknowledge receipt within 48 hours
- We will investigate and determine severity
- A fix will be developed and tested
- A security advisory will be published alongside the fix
- Credit will be given to the reporter (unless anonymity is requested)
This project is hardened against the following standards:
- NIST SP 800-53 Rev 5 — AC, AU, IA, SC, SI control families
- DoD STIG — Secure coding and configuration requirements
- FIPS 140-2/3 — Cryptographic module requirements (HTTPS enforcement)
- HTTPS-only transport (rejects plaintext HTTP)
- File-based credential loading (Docker/K8s secrets compatible)
- Token file permission validation
- Typed error hierarchy with sanitized messages (no data leakage)
- Structured audit logging (NIST AU-2/AU-3)
- Token-bucket rate limiting with exponential backoff
- Input validation via Zod schemas (whitelist approach)
- No use of
eval,exec, or dynamic code execution
Dependencies are monitored via:
- Dependabot — Weekly automated dependency updates
- npm audit — Run on every CI build (critical threshold)
- CycloneDX SBOM — Generated on each release for supply chain transparency