# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in agent-tempo, please report it responsibly.

**Do NOT open a public GitHub issue for security vulnerabilities.**

### How to Report

1. **GitHub Security Advisories** (preferred): Go to the [Security Advisories](https://github.com/vinceblank/agent-tempo/security/advisories) page and click "Report a vulnerability."

2. **Email**: If you prefer email, contact the maintainers directly through their GitHub profile.

### What to Include

- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

### Response Timeline

- **Acknowledgment**: Within 48 hours of your report.
- **Assessment**: We will evaluate the severity and scope within 1 week.
- **Fix**: Critical vulnerabilities will be prioritized and patched as quickly as possible.

### Scope

This policy covers the agent-tempo MCP server codebase. Note that agent-tempo coordinates Claude Code sessions via Temporal — security of the underlying Temporal server and Claude Code sessions is outside our scope.

## Supported Versions

| Version | Supported |
| ------- | --------- |
| Latest  | Yes       |
| < Latest | No       |

We recommend always running the latest version.
