otto-support/SECURITY.md

Security Policy

Important Note

This repository contains an intentionally vulnerable MCP server implementation designed for security research and education. The vulnerabilities present in this code are by design and should not be reported as security issues.

Reporting Security Issues

If you discover a security issue that is not part of the intentional design (e.g., a vulnerability in the repository infrastructure, CI/CD pipeline, or dependencies), please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please email [email protected] with:

• A description of the vulnerability
• Steps to reproduce
• Potential impact

We will acknowledge receipt within 48 hours and provide a detailed response within 5 business days.

Scope

The following are in scope for security reports:

• Vulnerabilities in build/release infrastructure
• Dependency vulnerabilities that could affect users running the tool
• Credential or secret exposure (beyond the intentional demo secrets)

The following are out of scope:

• Vulnerabilities intentionally built into the MCP server
• Issues documented in the README as part of the exercise