| Version | Supported |
|---|---|
| main branch | Yes |
If you discover a security vulnerability in this project, please report it responsibly.
Do NOT open a public GitHub issue for security vulnerabilities.
- GitHub Security Advisories (preferred): use the "Report a vulnerability" button on the Security tab of this repository.
- Email: send details to otis22@gmail.com with subject
[SECURITY] vetmanager-mcp.
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment: within 48 hours
- Initial assessment: within 7 days
- Fix or mitigation: as soon as reasonably possible, depending on severity
The following are in scope:
- Authentication and authorization bypasses
- Credential or token leakage
- Injection vulnerabilities (SQL, command, XSS)
- CSRF bypasses
- SSRF via host resolution
- Service bearer tokens are shown once, stored hash-only, bound to a service account, and issued through fixed access presets with runtime scope preflight.
- Depersonalized bearer tokens use a centralized response sanitizer and fail closed with a safe error instead of returning raw payload; Vetmanager login/password credentials are used only for token exchange and are not stored after submit.
Out of scope:
- Vulnerabilities in upstream Vetmanager REST API
- Issues requiring physical access to the server
- Social engineering attacks