Please use GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability). You should receive an acknowledgment within 72 hours. Please do not open public issues for security reports.

• Auth: a single static bearer token per deployment (Modal secret mcp-fea-token). Anyone holding the token can submit solves up to the configured rate/concurrency/daily caps. Rotate by updating the secret and redeploying. There are no user accounts and no per-user data isolation — treat one deployment as one trust domain.
• Untrusted input: STEP files are attacker-controlled binary input to OpenCASCADE. All CAD parsing runs in short-lived, wall-clock-capped subprocesses (endpoint: inspect_worker; solver: isolated worker in its own container) — a malformed file can crash its worker, never the endpoint, and the task fails with a specific code.
• Resource abuse: request-body cap (40 MB), STEP cap (25 MB), per-token sliding-window rate limit, global concurrent-solve cap, daily solve budget, and an operator kill switch (MCP_FEA_DISABLE_SPAWN=1). All env-tunable; see README.
• Data handling: geometry and results live in the Modal Dict task store for 24 h (task TTL) and in ephemeral container filesystems during a solve. No third-party services are called; step_url fetches are the one outbound network path — the server downloads whatever URL the client supplies (size-capped); deploy behind your own policy if SSRF to internal hosts is a concern in your network (Modal containers have no privileged network position).
• Rendered viewer: the MCP Apps template is fully self-contained (vendored Three.js, no external requests) and runs in the host's sandboxed iframe under the host's CSP.

OAuth, multi-tenancy, per-user quotas, audit logging. If you need these, front the endpoint with your own gateway.