If you discover a security vulnerability within MCP², please do NOT report it publicly (e.g., via GitHub issues).

Instead, please report it via:

• Private disclosure via GitHub Security Advisories (preferred)

If private reporting is unavailable, open a regular issue without sensitive details and request a secure contact channel.

We will investigate all reports and provide a response.