Request Guard MCP processes security-sensitive request metadata and can integrate with authentication and persistence systems. Please report vulnerabilities privately and handle test data carefully.

Security fixes target the default branch and the latest released version. Older releases may require an upgrade to receive a fix.

Use GitHub's private vulnerability reporting whenever possible. Do not open a public issue or pull request containing vulnerability details.

If private vulnerability reporting is unavailable, email rhamenator@gmail.com with the repository name and a concise description. Do not send credentials, production data, or live secrets.

Include, when safe and relevant:

• the affected version or commit;
• the affected component and configuration;
• reproduction steps or a minimal proof of concept;
• the potential impact;
• suggested mitigations or fixes; and
• a secure way to follow up.

We aim to acknowledge complete reports within 72 hours. Validation, remediation, disclosure timing, and credit will be coordinated with the reporter based on severity and complexity.

• Test only systems and data you own or are authorized to assess.
• Avoid privacy violations, service disruption, persistence, destructive actions, and unnecessary data access.
• Stop testing and report promptly if you encounter sensitive data or affect other users.
• Allow reasonable time for a fix before public disclosure.

Good-faith research that follows this policy will be handled constructively.