If you discover a security vulnerability in the JustRouting MCP server, please report it privately — do not open a public issue:

1. Preferred: use GitHub's private vulnerability reporting
2. Alternative: email hello@justrouting.tech

Please include a description of the vulnerability, affected versions, and steps to reproduce. We aim to acknowledge reports within a few days and to release a fix as soon as possible.

This policy covers the JustRouting MCP server in this repository (the cmd/ binary, its tools, and the installer). Issues in the JustRouting API service itself should be reported through the same channels.