Security updates are provided for the latest major version. Users running older versions are encouraged to upgrade to receive security fixes.

Please do not report security vulnerabilities through public GitHub issues.

To report a security vulnerability in Firefox Relay MCP Server:

1. Email: Send an email to security@anonsec.dev with the following information:

   • Type of vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested mitigation (if any)

2. Encrypted Reporting (Recommended):

   • For sensitive information, use our PGP key to encrypt your report
   • PGP Key ID: ANONSEC-SECURITY-2026
   • Key available at: https://anonsec.dev/security.asc

3. Response Time: We aim to acknowledge all reports within 24 hours and provide a more detailed response within 72 hours.

1. Acknowledgment: You will receive an acknowledgment of your report within 24 hours
2. Assessment: Our security team will assess the report and determine the severity
3. Remediation: We will work on a fix and test it thoroughly
4. Disclosure: We will coordinate with you on public disclosure timing
5. Credit: We will credit you in the release notes (unless you prefer to remain anonymous)

This project implements the following security measures:

• AES-256-GCM Encryption for all data at rest
• Immutable Audit Logs for all operations
• Request ID Tracking for traceability
• Input Validation for all tool parameters
• OTP Code Masking in responses (never exposed in plain text)
• Sensitive Data Redaction in audit logs
• Type Safety through TypeScript strict mode

• Never commit encryption keys, API keys, or other secrets to version control
• Use environment variables for sensitive configuration
• Rotate encryption keys periodically
• Monitor audit logs for suspicious activity
• Keep dependencies updated

• OWASP Security Guidelines
• NIST Post-Quantum Cryptography
• AES-256-GCM Specification

Security advisories will be published in the GitHub Security Advisories section and in the CHANGELOG.md file.