# Security Policy

## Reporting Vulnerabilities Found by mcpsec

If you discover a vulnerability using mcpsec, please follow responsible disclosure practices:

1. Report to the affected project's security team first
2. Wait for acknowledgment and fix before public disclosure
3. Follow the project's security policy

## Reporting Issues in mcpsec Itself

If you find a security issue in mcpsec itself, please open a [GitHub Security Advisory](https://github.com/manthanghasadiya/mcpsec/security/advisories/new) on this repository.

## Disclaimer

mcpsec is intended for **authorized security testing only**. Only scan MCP servers you own or have explicit permission to test. The authors are not responsible for misuse.
