Please do NOT report security vulnerabilities through public GitHub Issues.

If you discover a security vulnerability in this project, please report it privately to maintain responsible disclosure. We take all security reports seriously and will respond promptly.

Option 1: GitHub Private Security Advisory (Preferred)

Use GitHub's built-in private vulnerability reporting:

1. Navigate to the Security tab of this repository.
2. Click "Report a vulnerability".
3. Fill out the advisory form with as much detail as possible.

Option 2: Email

Send an encrypted email to: [INSERT MAINTAINER SECURITY EMAIL]

PGP Key Fingerprint: [INSERT PGP FINGERPRINT]

-----BEGIN PGP PUBLIC KEY BLOCK-----
[INSERT PGP PUBLIC KEY HERE]
-----END PGP PUBLIC KEY BLOCK-----

Please include the following in your report:

• Type of vulnerability (e.g., authentication bypass, injection, information disclosure)
• Affected component (e.g., src/middleware/auth.ts, src/api/client.ts)
• Steps to reproduce the vulnerability
• Potential impact if exploited
• Any suggested mitigations you have identified
• Your contact information for follow-up questions

We provide security updates for the following versions:

We strongly recommend always using the latest version of this template.

We follow responsible disclosure principles. We will work with you to coordinate public disclosure after a fix is available.

When deploying this template, please follow these security recommendations:

• Never commit secrets to source control.

• Use Cloudflare Workers Secrets for TARGET_API_KEY and MCP_AUTH_KEY:

  wrangler secret put TARGET_API_KEY
  wrangler secret put MCP_AUTH_KEY

• Rotate the MCP_AUTH_KEY periodically.

• Always set a strong MCP_AUTH_KEY — use a cryptographically random value of at least 32 bytes:

  openssl rand -hex 32

• The auth middleware uses timing-safe comparison to prevent timing attacks.

• The TARGET_API_KEY is only used server-side in the Worker; it is never exposed to clients.
• All outbound requests from the Worker use HTTPS.

• Dependencies are monitored by Dependabot (see .github/workflows/dependabot.yml).
• Run pnpm audit regularly to check for known vulnerabilities.

This security policy covers the source code in this repository. It does not cover:

• Third-party dependencies (report those to their respective projects)
• Vulnerabilities in Cloudflare Workers infrastructure (report to Cloudflare)
• The MCP SDK itself (report to Anthropic's MCP repo)

We appreciate responsible disclosure from the security community. With your permission, we will acknowledge your contribution here.

No reports yet — be the first!