# Security Policy

mcp-video shells out to FFmpeg and handles local media paths, so security reports are taken seriously.

## Supported Versions

Security fixes target the repository's default branch and the latest published package version. Older versions may receive guidance, but fixes are not backported unless a maintainer explicitly announces that support window.

## Reporting a Vulnerability

Please do not open a public GitHub issue for vulnerabilities.

Use GitHub Security Advisories for this repository. If that is unavailable, follow the private support path in `SUPPORT.md` and include only the minimum detail needed to establish contact.

Helpful reports include:

- The affected MCP tool, CLI command, or Python API.
- A minimal reproduction using non-sensitive media.
- The expected impact, such as command injection, path traversal, unsafe file overwrite, denial of service, dependency compromise, or secret exposure.
- Your OS, Python version, FFmpeg version, and mcp-video version.

## Response Expectations

- Initial acknowledgment target: within 3 business days.
- Triage/update target: within 7 business days.
- Fix timeline depends on severity and complexity.

Confirmed vulnerabilities will be fixed in a private branch when possible, then disclosed after a patched release or clear mitigation is available.

## Security Scope

In scope:

- FFmpeg filter injection or unsafe command construction.
- Path validation bypasses, null-byte handling, and unsafe overwrites.
- Server-side validation gaps that allow resource exhaustion or unexpected local file access.
- Dependency or packaging issues that affect normal installation or runtime.

Out of scope:

- Reports requiring malicious local code execution before using mcp-video.
- Issues only affecting third-party FFmpeg builds outside this project.
- Denial-of-service reports that require unrealistic media sizes beyond documented limits.
