Muninn is early-stage software. Security fixes should target the current main branch unless a release branch policy is added later.

If you find a vulnerability, avoid posting exploit details publicly until maintainers have had time to respond. Open a private advisory on the hosting platform when available, or contact the maintainers through the repository's preferred private channel.

Include:

• A concise description of the issue.
• Steps to reproduce.
• Affected files, commands, or MCP tool inputs.
• Impact and any suggested mitigation.

Muninn writes per-repository SQLite databases under .muninn-indexes/ in the Muninn working directory. Those databases may contain local file paths, symbol names, and import text from indexed codebases. Treat them as local runtime data and do not commit or publish them.

The server accepts repository paths from MCP tool inputs and reads TypeScript files from those paths. Only connect Muninn to MCP clients and repositories you trust.

When filing public issues, avoid attaching:

• .muninn-indexes/ or .muninn.db files.
• Private source files or directory listings.
• Access tokens, environment files, SSH keys, certificates, or logs containing credentials.