Please use GitHub private vulnerability reporting on this repository (Security → Report a vulnerability). If that is unavailable, open an issue saying only that you have a security report and how to reach you — do not post details publicly.

This is a solo-maintained project: reports are read and taken seriously, but there is no guaranteed response SLA. Critical issues (credential exposure, auth bypass, RCE) get priority.

In scope: the octoport hub (HTTP surface, auth, policy enforcement, OAuth flows, file handling), the setup wizard's config rewriting, and the Docker deployment files.

Out of scope: vulnerabilities in downstream MCP servers, in your IdP, or requiring an already-compromised host account.

The security model is documented in docs/threat-model.md; hardening history lives in CHANGELOG.md. Supported version: the latest release only.