Use GitHub's private reporting: Security → Report a vulnerability on the repository. That opens a channel only you and I can read, which is what you want before anything is fixed.

If that page is unavailable to you for any reason, open a normal issue saying you have found something and want a private channel, without the details, and I will open one.

Please include, as far as you have it: the arr-mcp version, how it is deployed (Docker image or from source), which services are configured, and the smallest sequence of calls that shows the problem. A confirm token, MCP token or OAuth token from your own instance is not useful to me and should stay yours; redact them.

This is a one-person project, so there is no service-level agreement. I will acknowledge a report within a week, tell you whether I agree it is a vulnerability and why, and keep you updated while it is being fixed. Fixes ship as a normal release with the advisory published alongside. There is no bounty. Credit in the advisory if you want it, and none if you would rather not be named.

Only the latest release is supported. There are no backports to older versions; the fix will be in the next release and the upgrade is a tag change.

Things worth reporting:

• Reaching /mcp or the config UI without valid credentials, or any bypass of allowed_hosts.
• Any way to read a service API key, an MCP token, or the config UI password hash out of a tool response, a log line, an error message or the audit trail.
• Any way to make a write happen without passing the permission tier, or with a confirmation token that was not issued for that exact operation and target. This includes a token bound to one target being accepted for another.
• Content from a configured service escaping its fence and reaching the model as instruction rather than as data.
• Anything wrong with the published image's provenance, or with the release workflow that builds it.

Things that are known and documented rather than vulnerabilities:

• OAuth tokens are not revocable before they expire. /mcp verifies an auth.oauth token's signature, issuer, audience, scope and expiry, but does not introspect it. A token revoked at the issuer is still accepted here until it runs out on its own. The config UI's own credential is separate and unaffected. See MCP07.
• Binding 0.0.0.0, and exposure to the internet. The container has to be reachable across the LAN. It is not designed to be internet-facing, and forwarding the port to it is a deployment decision, not a defect.
• config.yaml is plaintext. Filesystem permissions on the config volume are the boundary; there is no encryption at rest.
• The Proxmox scripts run a pinned copy of Community Scripts' engine. proxmox/ct/arr-mcp.sh sources their engine at commit 5514fdfd6c3fe5fb74d91a42863c807a99c617a5 instead of main, and exports that base so every further engine file build.func fetches comes from the same commit. This also holds for update inside a container: the script replaces an engine URL baked in at install time when it points at the official repository, and keeps one that points elsewhere. The first fetch of misc/update.sh by /usr/bin/update still uses the baked URL, before the script runs; a container installed before this pin keeps that bootstrap on main until /usr/bin/update is regenerated. Engine files not fetched through that variable are not covered. Dependabot cannot bump a raw URL, so a bump is by hand: change the SHA in proxmox/ct/arr-mcp.sh and in this file together. A test enforces that.
• A model that confirms its own preview. The confirm handshake guarantees that the first call cannot mutate anything, not that a determined caller cannot call twice. See MCP06.
• Vulnerabilities in Radarr, Sonarr, Jellyfin and the rest. Report those to the projects themselves. If arr-mcp makes one materially easier to reach, that part is in scope, so say so.

docs/security.md sets out what this server defends against, how, and what it deliberately does not solve, walked against the OWASP MCP Top 10. Reading the "what it does not solve" paragraphs first is the quickest way to tell whether what you have found is already known.