Please do not open public GitHub issues for vulnerabilities in this package.
Preferred channel — GitHub private vulnerability reporting: Report a vulnerability
A response is sent within 7 days. A fix or mitigation plan is shared within 30 days of confirmation. If the issue is also present in the upstream ProfileKit API (this package is a thin MCP wrapper around it), the report is forwarded with credit preserved.
In scope:
- This npm package
profilekit-mcp(source:src/, build:dist/). - Tool definitions exposed via MCP (
list_cards,list_themes,render). - Catalog fetch path (
src/fetch-catalog.ts) and URL construction (src/url.ts).
Out of scope:
- Vulnerabilities in the upstream ProfileKit Vercel deployment (
https://profilekit.vercel.app/api/*) — report to the ProfileKit repo. - Vulnerabilities in
@modelcontextprotocol/sdk— report upstream at https://github.com/modelcontextprotocol/typescript-sdk/security. - Misconfiguration in the consuming MCP host (Claude Code, Codex CLI, ChatGPT Apps).
Only the latest minor on npm receives security fixes. Pre-1.0, breaking fixes may ship in patch releases — pin a minor (~0.2.0) if you need stability.