Please do not open public GitHub issues for security problems.

Email security reports to the repository maintainers via GitHub private security advisories: https://github.com/GroepOnline/kater-dev-tools/security/advisories/new

Include:

• Description of the issue and impact
• Steps to reproduce
• Affected version/commit
• Suggested fix (if any)

We aim to acknowledge reports within 72 hours.

Kater exposes MCP tools over HTTP/SSE. Treat a public instance like an API gateway:

1. Never expose /sse without auth. Set KATER_PUBLIC=1 and KATER_AUTH_MODE=oauth or apikey.
2. Use OAuth for ChatGPT Remote MCP — built-in PKCE flow at /authorize and /token.
3. Use API keys for Cursor/agents — Authorization: Bearer <key> on MCP and REST requests.
4. Enable rate limiting — KATER_RATE_LIMIT=60 (default when public). Applied to REST, MCP /sse, and WebSocket; X-Forwarded-For is honored only from loopback/private proxy peers or with KATER_TRUST_PROXY=1.
5. Restrict CORS — avoid * on public deployments; set KATER_CORS_ORIGINS.
6. Keep adapter secrets in env — never commit .env; Kater redacts secrets in API/MCP tool responses.
7. Bind to loopback behind a tunnel — Cloudflare Tunnel or Tailscale; do not expose raw ports.
8. Set an admin key — KATER_ADMIN_KEY separates tool usage from settings and catalog credential changes. In public mode, settings mutations and Catalog Connect mutations (POST /credentials, POST /oauth/start, DELETE /connections/{id}) are blocked without it. Masked GET /connections stays authenticated-only.
9. Secret storage stays local-only and masked — dashboard credential saves (manual POST /credentials included) persist to the gitignored .kater/settings.json, written 0600 with a 0700 directory, and are masked (***) in every API response. ChefVault (docs/ops/chefvault.md) remains the referenced durable team sink; this gateway does not write Vault items, mcp.json, or git.
10. Public Connect origin is configured, not requested — set KATER_CONNECT_PUBLIC_BASE_URL=https://<canonical-host>. Host / X-Forwarded-Host are not used to build OAuth redirect URLs in public mode. Localhost HTTP is allowed only on loopback.
11. Keep client registration closed — public /register is disabled unless KATER_ALLOW_DYNAMIC_REGISTRATION=1 and KATER_REGISTRATION_TOKEN is set. Prefer pre-seeded first-party clients/admin bootstrap over anonymous runtime registration.
12. Dashboard key — KATER_DASHBOARD_KEY is an optional shortcut that bypasses OAuth token validation for a browser dashboard session in oauth mode. Leave unset unless you need it.

OAuth redirect_uri values must be https (or http for loopback per RFC 8252); dangerous schemes (javascript:, data:) are rejected at registration.

Run kater doctor before going live — it flags public deployments without auth.