The full threat model and operational notes live at docs/security.md.

Open a private security advisory on this repository. Do not file a public issue for security concerns.

We aim to acknowledge reports within 5 business days. Fixes for confirmed issues ship in the next patch release.

Only the latest published version on npm receives security fixes. Pin a specific version in your MCP client config and watch Releases for advisories.