We actively support the following versions with security updates:

If you discover a security vulnerability in VA Design System Monitor, please report it responsibly:

• Do NOT create a public GitHub issue
• Create a security advisory on GitHub: https://github.com/amponce/va-design-system-monitor/security
• Include detailed steps to reproduce
• Provide impact assessment

• Create a GitHub issue for non-security bugs
• Use discussions for questions

This tool makes HTTP requests to:

• https://raw.githubusercontent.com/department-of-veterans-affairs/component-library/ (TypeScript definitions)
• https://raw.githubusercontent.com/department-of-veterans-affairs/component-library/ (Storybook examples)

• Optional GitHub token for rate limit increases
• No other authentication required

• No user data is collected or stored
• Component definitions are cached temporarily in memory
• No sensitive information is transmitted

We regularly monitor and update dependencies for security vulnerabilities. Key dependencies:

• @modelcontextprotocol/sdk - MCP service protocol
• node-fetch - HTTP requests (Node 14.x compatibility)

When using this tool:

1. Keep the package updated to the latest version
2. Use environment variables for GitHub tokens (never hardcode)
3. Run in secure environments for production usage
4. Review examples before implementing in production code