Report suspected vulnerabilities privately through the repository's Security → Advisories → Report a vulnerability option when available: https://github.com/up2itnow0822/webmcp-sdk/security/advisories/new. Otherwise request a private channel through a verified maintainer profile contact. Do not post credentials, private keys, signatures or an active exploitation recipe publicly.

Include the affected version/commit, environment, impact and a minimal local reproduction with synthetic data. State whether the issue involves browser lifecycle, policy, payments, dependencies or the reference app. Response times are not guaranteed.

The 0.6.0 candidate contains breaking repairs; older installed versions remain affected until a reviewed release is published and applications upgrade. Local review is not a formal security audit or funded-wallet certification. Review the threat model, migration guide and release gates. No absolute-security warranty, custody or recovery service is provided.