Use Report a vulnerability to contact the maintainers privately. Do not open a public issue for an exposed secret, access problem, or leak of member information.

Include the affected page or file, the commit or version if known, steps to reproduce, and the possible impact. Use a small example with made-up data. Do not include passwords, live tokens, identity documents, or other members’ records.

Only test systems and accounts you have permission to use. Stop if you can access someone else’s information; describe what happened without downloading more data.

Report problems against the latest main, including the Hub application and the content service (mcp-content/). There is no published long-term support schedule for older snapshots. Maintainers will assess the report, agree on a fix and disclosure plan, and keep sensitive details private while it is being handled. Response times are not guaranteed.

For an ordinary bug with no security impact, use the issue forms.