Security fixes are made against the latest version published on npm. Upgrade to the current release before reporting a problem that may already be fixed.

Use GitHub's private vulnerability reporting form for a suspected vulnerability. Please do not open a public issue until a fix is available.

Include the affected version, a short reproduction, the impact you observed, and any suggested fix. Do not send a real YNAB token, budget export, transaction data, or other financial information. Replace private values with clearly marked examples.

This project covers the local MCP server and its handling of YNAB credentials and data. Report problems in YNAB's service or API directly to YNAB.