Skip to content

security.md

Latest commit

 

History

History
43 lines (27 loc) · 1.95 KB

security.md

File metadata and controls

43 lines (27 loc) · 1.95 KB
Raw

Security policy

Supported versions

openapi-go-mcp is pre-1.0 and currently supports security fixes only on the latest minor version. Once 1.0 ships, this section will list the supported branches.

Version Supported
0.1.x ✅
< 0.1 ❌

Reporting a vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Report privately via GitHub's private vulnerability reporting feature, or e-mail the maintainer (see git log for the author address).

Include:

  • A description of the vulnerability and its impact
  • Steps to reproduce, ideally with a minimal spec or code sample
  • The version (or commit SHA) where you observed the issue
  • Any mitigations you've considered

You should receive an acknowledgement within 5 business days. Coordinated disclosure timeline: 90 days from initial report, or sooner if a fix lands before then.

Scope

In scope:

  • The CLI binary and library packages under cmd/ and pkg/.
  • Code generated by the CLI when used as documented.

Out of scope:

  • Vulnerabilities in upstream dependencies — please report them to the relevant project.
  • Issues that require an attacker to already have write access to the user's spec files or generated source.

Known security considerations

  • The generator embeds OpenAPI description fields verbatim into Go string literals (escaped). A malicious spec cannot inject Go code, but very long descriptions inflate binary size.
  • Generated handlers forward MCP-supplied arguments to a user-configured HTTP client. The destination is not validated against the spec's servers list — operators must constrain the base URL passed to the oapi-codegen client.
  • loader.Load enables external $ref resolution. Specs that reference unintended local files could leak content into the generated schemas. Treat untrusted specs accordingly.