# Security Policy

## Supported Versions

We release patches for security vulnerabilities in the following versions:

| Version | Supported          |
| ------- | ------------------ |
| 5.x.x   | :white_check_mark: |
| 4.x.x   | :white_check_mark: |
| < 4.0   | :x:                |

## Reporting a Vulnerability

We take the security of claude-faf-mcp seriously. If you believe you have found a security vulnerability, please report it to us as described below.

### Please Do Not

- Open a public GitHub issue for security vulnerabilities
- Disclose the vulnerability publicly before we have had a chance to address it
- Exploit the vulnerability beyond what is necessary to demonstrate it

### Please Do

**Report security issues via email to: team@faf.one**

Include the following information:

- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting)
- Full paths of source file(s) related to the manifestation of the issue
- Location of the affected source code (tag/branch/commit or direct URL)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it

### What to Expect

When you report a security issue, you can expect:

1. **Acknowledgment within 24 hours** - We will confirm receipt of your report
2. **Initial assessment within 72 hours** - We will provide our initial evaluation
3. **Regular updates** - We will keep you informed as we work on a fix
4. **Coordinated disclosure** - We will work with you on disclosure timing
5. **Credit** - We will acknowledge your contribution (unless you prefer to remain anonymous)

### Our Commitment

- We will respond to your report promptly
- We will keep you informed of our progress
- We will treat your report confidentially
- We will credit you for responsible disclosure (if desired)
- We will work to issue a fix as quickly as possible

## Security Best Practices

When using claude-faf-mcp:

### For Users

- Keep your installation up to date
- Only install from official sources (npm, GitHub releases)
- Verify package integrity when possible
- Review the permissions required by the MCP server
- Use Claude Desktop from official Anthropic channels only

### For Contributors

- Follow secure coding practices
- Never commit sensitive data (API keys, tokens, credentials)
- Use environment variables for configuration
- Validate all inputs
- Follow our TypeScript strict mode requirements
- Run security audits before submitting PRs:
  ```bash
  npm audit
  npm run build
  npm test
  ```

## Dependencies

We maintain minimal dependencies to reduce attack surface:

- Only one production dependency (MCP SDK)
- Regular dependency audits
- Automated security updates via Dependabot
- No deprecated or unmaintained dependencies

## Known Security Considerations

### MCP Protocol

- claude-faf-mcp operates within the Model Context Protocol (MCP) framework
- It requires filesystem access to manage .faf files
- All operations are local to the user's machine
- No data is transmitted to external services

### Filesystem Access

The server requires read/write access to:
- Project directories for .faf file management
- Claude Desktop configuration directory (for MCP setup)

This access is necessary for core functionality and is limited to user-initiated operations.

## Security Updates

- Security updates are released as soon as fixes are available
- Critical vulnerabilities receive immediate attention
- All security updates are documented in CHANGELOG.md
- Users are notified via GitHub Security Advisories

## Vulnerability Disclosure Process

Our typical timeline:

1. **Day 0**: Report received
2. **Day 1**: Acknowledgment sent
3. **Day 3**: Initial assessment completed
4. **Day 7-30**: Fix developed and tested
5. **Day 30-90**: Coordinated disclosure
6. **Day 90+**: Public disclosure if fix is delayed

We aim for fixes within 30 days for high-severity issues.

## Security Hall of Fame

We recognize researchers who help us improve security:

*No vulnerabilities reported yet*

If you report a vulnerability, we will list you here (with your permission).

## Additional Resources

- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [CWE Top 25](https://cwe.mitre.org/top25/)
- [NPM Security Best Practices](https://docs.npmjs.com/packages-and-modules/securing-your-code)
- [Node.js Security Best Practices](https://nodejs.org/en/docs/guides/security/)

## Contact

- **Security issues**: team@faf.one
- **General questions**: [GitHub Discussions](https://github.com/Wolfe-Jam/faf/discussions)
- **Project maintainer**: Wolfe James ([ORCID: 0009-0007-0801-3841](https://orcid.org/0009-0007-0801-3841))

---

**Last updated**: April 2026

Thank you for helping keep claude-faf-mcp and its users safe.
