diff --git a/.gitignore b/.gitignore
index abd7c3b..217df44 100644
--- a/.gitignore
+++ b/.gitignore
@@ -64,7 +64,8 @@ typings/
 
 # dotenv environment variables file
 .env
-.env.test
+.env.*
+!.env.example
 
 # parcel-bundler cache (https://parceljs.org/)
 .cache
diff --git a/README.md b/README.md
index 83a7d8b..4de1870 100644
--- a/README.md
+++ b/README.md
@@ -496,6 +496,16 @@ See [open issues](https://github.com/taskade/mcp/issues) for planned features an
 
 ---
 
+## Privacy & Security
+
+Your Taskade API token authorizes the MCP server to call the Taskade public API on your behalf. The server talks **only** to `https://www.taskade.com/api/v1` and does not send your data to other third-party services.
+
+- **Privacy** — see the [Taskade Privacy Policy](https://www.taskade.com/privacy).
+- **Security & vulnerability reporting** — see [SECURITY.md](./SECURITY.md).
+- Store your token in an environment variable; never commit it.
+
+---
+
 ## Contributing
 
 Help us improve MCP tools, OpenAPI workflows, and agent capabilities.
diff --git a/SECURITY.md b/SECURITY.md
index 91fa471..cd05095 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,17 +2,52 @@
 
 ## Reporting a Vulnerability
 
-Do not disclose security vulnerabilities publicly. Email [hello@taskade.com](mailto:hello@taskade.com) with details.
+**Please report security issues privately — do not open a public issue or PR.**
+
+- Preferred: open a [GitHub private security advisory](https://github.com/taskade/mcp/security/advisories/new) (Security → Report a vulnerability).
+- Or email [hello@taskade.com](mailto:hello@taskade.com) with details and reproduction steps.
+
+We aim to acknowledge reports within **3 business days** and to provide a remediation
+timeline after triage. Please give us a reasonable window to ship a fix before any
+public disclosure. We're happy to credit reporters who request it.
 
 ## Token Handling
 
-- Store API tokens in environment variables only — never hardcode in source files.
+- Store API tokens in environment variables only — never hardcode them in source files.
 - `.env` files are gitignored — never commit tokens to version control.
 - Rotate tokens immediately if compromised.
 - Generate tokens at [taskade.com/settings/api](https://www.taskade.com/settings/api).
 
 ## Transport Security
 
-- Use HTTPS/TLS for HTTP/SSE mode in production.
-- Tokens passed via query parameters in HTTP mode may be logged by proxies or web servers.
-- The stdio transport (default for Claude Desktop / Cursor) does not expose tokens over the network.
+- The stdio transport (default for Claude Desktop / Cursor / VS Code) does not expose tokens over the network.
+- Use HTTPS/TLS for any HTTP-based transport in production.
+- The HTTP/SSE transport currently passes the token as an `access_token` URL query parameter, which proxies and servers may log. Until a header-based transport is available, prefer **stdio** (token via the `TASKADE_API_KEY` environment variable), especially in production.
+
+## Never Commit Secrets
+
+This is a public repository. Never commit:
+
+```
+.env, .env.*            # environment files
+*.key, *.pem            # private keys / certificates
+*credentials*, *secret* # credential dumps
+.mcpregistry_*          # MCP registry auth tokens
+```
+
+`.env*` files (except `.env.example`) and `.mcpregistry_*` are gitignored and excluded from the npm package; the key/credential patterns above are **not** auto-ignored, so sanity-check your staged changes before committing:
+
+```bash
+git diff --cached | grep -iE "(token|key|secret|password|credential)" | grep -v placeholder
+```
+
+If you accidentally commit a secret: **do not push** (or if already pushed, rotate the
+credential immediately), then remove it from history and notify a maintainer. See
+[GitHub: removing sensitive data](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository).
+
+## Privacy
+
+Taskade's data practices are described in the [Taskade Privacy Policy](https://www.taskade.com/privacy).
+The MCP server sends requests only to the Taskade public API (`https://www.taskade.com/api/v1`)
+using the token you provide; it does not send your data to other third-party services. (In
+HTTP/SSE mode the token travels in the request URL and may be logged — prefer stdio.)
diff --git a/packages/openapi-codegen/src/runtime.ts b/packages/openapi-codegen/src/runtime.ts
index 870d5bf..c21e4d6 100644
--- a/packages/openapi-codegen/src/runtime.ts
+++ b/packages/openapi-codegen/src/runtime.ts
@@ -168,7 +168,7 @@ export class OpenAPIToolRuntimeConfig {
   }
 
   get fetch() {
-    const fetch = this.config.fetch ?? window['fetch'];
+    const fetch = this.config.fetch ?? globalThis.fetch;
 
     if (!fetch) {
       throw new Error('fetch is not defined');
diff --git a/packages/server/src/tools.generated.ts b/packages/server/src/tools.generated.ts
index 33b6b74..be02955 100644
--- a/packages/server/src/tools.generated.ts
+++ b/packages/server/src/tools.generated.ts
@@ -175,7 +175,7 @@ export class OpenAPIToolRuntimeConfig {
   }
 
   get fetch() {
-    const fetch = this.config.fetch ?? window['fetch'];
+    const fetch = this.config.fetch ?? globalThis.fetch;
 
     if (!fetch) {
       throw new Error('fetch is not defined');