Do not open a public issue for vulnerabilities that could expose credentials, private campaign data, GM-only content, arbitrary files, or remote execution. Until an affected repository's Security page explicitly offers private vulnerability reporting, contact the organization through the email address published on the SagaSmithAI GitHub profile and include only the minimum details needed to establish a private channel. When GitHub private vulnerability reporting is visibly enabled for that repository, prefer it.

The current default branch of each active repository receives security fixes. Tagged releases may receive fixes when they are still used by the current platform, but there is no long-term support promise yet.

• MCP stdio servers are intended for trusted local execution. Remote HTTP/SSE adapters require explicit authentication, origin policy, and network allowlists.
• SagaSmith Web in SagaSmith-Web is an Internet-facing browser product and orchestration layer. Account, room, identity, object-storage, internal-service, quota, and Agent credentials must remain server-side, and every domain action must be re-authorized by the target MCP.
• Agent-supplied principal identifiers are not trusted. Hosts must inject a principal derived from the authenticated channel, and MCP servers must enforce campaign and actor grants.
• Browser, channel, and provider tokens must never be passed through to a domain MCP. Hosted callers use short-lived, target-audience delegations that keep caller/workload, requester, resource owner, acting host/character, allowed operation, room turn, base revision, and expiry distinct. Each HTTP request is authorized independently.
• A server-issued handle is an opaque state name, not a capability. Servers must bind handles to an owner and expiry, re-authorize every use, and return a safe recoverable error for expired or mismatched handles. Transport sessions and connection-pool identity are never authority.
• Player-visible responses must not contain GM-only rules, scenes, hidden combatants, private actor knowledge, or another branch's state.
• Imported PDFs, rulebooks, modules, templates, and skill assets are untrusted input. Enforce allowlisted roots, size/type limits, content-addressed storage, and provenance.
• Never submit provider keys, bot tokens, local config files, campaign databases, Chroma stores, imported commercial content, or generated artifacts containing private play data.
• Public repository visibility is not evidence that a Content Pack or embedded asset may be redistributed; report accidental publication of restricted source material privately.

Security fixes should include a regression test that demonstrates the prior boundary failure without publishing sensitive production data.