Skip to content

SECURITY.md

Latest commit

 

History

History
43 lines (28 loc) · 1.24 KB

SECURITY.md

File metadata and controls

43 lines (28 loc) · 1.24 KB
Raw

Security Policy

Cognia is a security-positioned product, and this package runs in the trust boundary of any MCP client that installs it. We take vulnerability reports seriously and respond quickly.

Reporting a vulnerability

Do not open a public issue for security reports.

Use GitHub's private vulnerability reporting: https://github.com/cogniahq/cognia-mcp/security/advisories/new

You will get an acknowledgement within 48 hours and a remediation timeline within 5 business days.

If GitHub Security Advisories are not available to you, email security@cogniahq.tech with the details. PGP available on request.

Scope

In scope for this repository:

  • The MCP server (src/server.ts, src/cli.ts)
  • The bundled REST client (src/client.ts, exported as @cogniahq/mcp/client)
  • Anything in dist/ shipped to npm under @cogniahq/mcp

Out of scope here (report to the Cognia security page instead):

  • The Cognia API surface (api.cogniahq.tech)
  • The encrypted backend, search pipeline, and admin console
  • The web app at https://cogniahq.tech

For backend issues see https://cogniahq.tech/security and the public threat model.

Supported versions

Version Supported
0.1.x yes

Older versions are unsupported.