Security
Reporting a vulnerability
Email [email protected] with a clear subject (e.g. "security report"), include reproduction steps and impact. We acknowledge within 2 business days and aim for a fix or mitigation within 30 days, coordinated with you on disclosure timing.
Data in transit and at rest
All client traffic is HTTPS via Cloudflare in front of our origin. Sessions are signed with a 256-bit secret. Database at-rest encryption is provided by the underlying managed PostgreSQL volume; backups are encrypted.
Access controls
Production access is limited to a small set of operators, requires hardware-backed MFA, and is logged. CI deployments use scoped deploy keys rotated annually. Secrets are never committed to the repository.
Scope of the MCP scan
The scan reaches out to the public URL you give it, exchanges the MCP handshake, and reads the server's published tools. It does not run code from the scanned server. Requests are short-lived, time-boxed, and rejected for loopback / RFC1918 / link-local / cloud-metadata addresses (anti-SSRF).
Questions about these terms? Contact [email protected].