Do not open a public issue for a vulnerability.

Report it privately: https://github.com/cjohnhanson/tisket/security/advisories/new

That opens a thread only you and the maintainer can read.

Include what an attacker gains, what they must already control to get it, the affected commit, and steps that reproduce it.

tisket has one maintainer, so response is best effort. Expect a reply within a week.

A confirmed report gets a fix and an advisory published together. You are credited unless you ask otherwise.

tisket stores issues as markdown files with YAML frontmatter, inside a repository. It serves a tracker over the Model Context Protocol, and it reads the trackers a stores.yml declares.

A declared tracker can come from content the reader does not control, such as a vendored dependency. A declaration decides what tisket opens, so its reach is one boundary. The MCP server is the other. It answers whoever drives it.

In scope:

• A document, a declaration, or a name reaching outside the directory it should be confined to.
• A fetch reaching a host or a path that no declaration named.
• Reading untrusted content leading to code execution.
• The MCP server answering for a path outside the tracker it serves.

Out of scope:

• A dependency advisory with no exploitable path through this tool. Report it to that dependency.
• Denial of service from a malformed local file, where the caller already controls that file.

Documented limits are not vulnerabilities. tisket confines every read and write through the mdstore-core crate, whose confined module carries a What this does not cover section in its module documentation. Read that section before you report a traversal issue.