docs+fix: privacy policy, SECURITY.md hardening, globalThis.fetch - #45
Merged
Conversation
|
There was a problem hiding this comment.
Pull request overview
This PR improves repository trust/security posture by adding privacy/security documentation and removing bracket-notation fetch access in the OpenAPI runtime to avoid scanner false positives and better support standard runtimes.
Changes:
- Add a Privacy & Security section to
README.mdlinking to Taskade’s Privacy Policy andSECURITY.md. - Harden
SECURITY.mdwith private reporting guidance, an acknowledgement SLA, and “never commit secrets” guidance. - Replace
window['fetch']withglobalThis.fetchin the OpenAPI runtime (and regenerated server tools output).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| SECURITY.md | Expands vulnerability reporting and secret-handling guidance; adds privacy pointer. |
| README.md | Adds a Privacy & Security section describing token usage and linking to policies. |
| packages/server/src/tools.generated.ts | Regenerated: switches runtime fetch fallback to globalThis.fetch. |
| packages/openapi-codegen/src/runtime.ts | Updates runtime fetch fallback to globalThis.fetch. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| .mcpregistry_* # MCP registry auth tokens | ||
| ``` | ||
|
|
||
| These patterns are covered by `.gitignore` and `packages/server/.npmignore`. Before committing, sanity-check your staged changes: |
Comment on lines
+23
to
+25
| - The stdio transport (default for Claude Desktop / Cursor / VS Code) does not expose tokens over the network. | ||
| - Use HTTPS/TLS for any HTTP-based transport in production. | ||
| - Avoid passing tokens in URL query parameters — they can be logged by proxies and web servers. Prefer the `Authorization` header or environment variables. |
| .mcpregistry_* # MCP registry auth tokens | ||
| ``` | ||
|
|
||
| `.env*` files are gitignored (except `.env.example`) and excluded from the npm package; the other patterns above are **not** auto-ignored, so sanity-check your staged changes before committing: |
Comment on lines
+51
to
+52
| The MCP server sends requests only to the Taskade public API (`https://www.taskade.com/api/v1`) | ||
| using the token you provide; it does not transmit your data to any third party. |
|
|
||
| ## Privacy & Security | ||
|
|
||
| Your Taskade API token authorizes the MCP server to call the Taskade public API on your behalf. The server talks **only** to `https://www.taskade.com/api/v1` and sends your data to no third party. |
Member
Author
✅ Validated → fixed → ready to merge
QA: |
- runtime.ts: window['fetch'] -> globalThis.fetch (standard global on Node 20+ and browsers; also clears the SafeSkill bracket-notation false positive). tools.generated.ts regenerated (single inlined-runtime line changed). - SECURITY.md: add private vulnerability reporting + disclosure SLA, a never-commit-secrets section with a pre-commit grep, and a Privacy pointer. - README: add a Privacy & Security section linking the Taskade Privacy Policy (Claude Connectors Directory requirement) and SECURITY.md.
Addresses Copilot review: .gitignore covered .env/.env.test but not .env.* (.env.local, .env.production, ...). Add .env.* with a !.env.example negation, and reword SECURITY.md to only claim what's truly auto-ignored (.env*), framing key/credential patterns as a pre-commit check.
…ty wording Addresses Copilot review: - Transport: acknowledge HTTP/SSE currently passes the token as an access_token query param (may be logged); recommend stdio instead of implying a header is used. - Never-commit: clarify .env* AND .mcpregistry_* are gitignored (only the key/credential patterns are not auto-ignored). - Privacy (SECURITY.md + README): scope the claim to 'no other third-party services' and note the HTTP/SSE URL-token logging caveat.
johnxie
force-pushed
the
docs/security-and-privacy
branch
from
June 5, 2026 12:01
39e953a to
1411900
Compare
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Three small trust/security wins (one is a Claude Connectors Directory prerequisite):
window['fetch']→globalThis.fetchinruntime.ts—globalThisis the standard global (Node 20+ and browsers), and it clears the 2 'critical' findings in the SafeSkill scan (bracket-notation false positives).Zero-regression
runtime.ts: 1-line change;globalThis.fetchis equivalent to the previous reference on the server's Node 20+ target.tools.generated.tsregenerated → exactly 1 line changed (the inlined runtime fetch line); 57 tools intact.yarn lintclean.Stacked on
tools.generated.ts. Will auto-retarget tomainwhen feat: tool annotations (title + readOnly/destructive hints) #44 merges.main(trivial follow-up).