Report privately — do not open a public issue.

Use GitHub's Security → Report a vulnerability at github.com/threadwire/mcp-telemetry/security/advisories/new, or email via the repo's About page.

Acknowledgement within 48 hours; fix or mitigation plan within 7 days.

In scope:

• Redaction bypass — a payload key that leaks through secret scrubbing
• Trace forgery / span injection through untrusted traceparent
• /ingest — span spam, oversized bodies, and stored-XSS payloads in span fields (mirror auth via --token; browser-origin CSRF is blocked at the server)
• Replay deserialization safety (mcp-trace --replay on hostile JSONL)
• Metric integrity (metrics_from_store aggregation errors)

Out of scope:

• The correctness of the MCP servers that emit the spans
• Network security of the OTLP/HTTP receiver you export to