Skip to content

chore: Add security policy documentation #1213

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jirispilka wants to merge 1 commit into
base: master
Choose a base branch
from
+36 −0
Open

chore: Add security policy documentation #1213

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Security Policy

## Supported versions

Only the latest released version of `@apify/actors-mcp-server` receives security updates.

## Reporting a vulnerability

Do not report security vulnerabilities through public GitHub issues.

Report vulnerabilities privately through one of these channels:

1. Email [security@apify.com](mailto:security@apify.com).
2. Use [GitHub private vulnerability reporting](https://github.com/apify/apify-mcp-server/security/advisories/new).

Follow [Apify's vulnerability disclosure policy](https://docs.apify.com/platform/security#how-to-report)
when testing or reporting a vulnerability.

Include:

- A description of the vulnerability and its potential impact.
- Steps to reproduce it and a proof of concept, if available.
- The affected package version, endpoint, or commit.
- Your assessment of its severity and any suggested mitigation.

We will acknowledge your report within 5 business days and keep you informed while we investigate.
Do not disclose the vulnerability publicly until it has been resolved or Apify has approved disclosure in writing.

## Scope

This policy covers the source code in this repository and the `@apify/actors-mcp-server` package.
Report vulnerabilities affecting the hosted `mcp.apify.com` service or other Apify services through
[Apify's vulnerability disclosure policy](https://docs.apify.com/platform/security#how-to-report).

Community Actors and third-party services are outside this repository's scope. Report vulnerabilities in them
to their respective maintainers.
Loading