# Security Policy

## Supported Versions

Only the latest `main` branch is supported. Please ensure you are running the
latest revision of any tool from this repository before reporting
vulnerabilities.

## Reporting a Vulnerability

Please **do not** open public GitHub issues for security vulnerabilities.

Two channels exist for this repository:

1. **The ASF Security Team** at [security@apache.org](mailto:security@apache.org)
   ([process](https://www.apache.org/security/)) — preferred for any
   vulnerability that could affect ASF infrastructure or projects in production.
2. **GitHub private vulnerability reporting** for this repository
   (["Security" tab → "Report a vulnerability"](https://github.com/apache/comdev/security/advisories/new))
   — appropriate for issues isolated to the tooling here (e.g. the
   `mcp/ponymail-mcp` server, the activity / highlights scripts).

When in doubt, prefer security@apache.org.

We aim to acknowledge reports within **5 business days** and provide a fix
or remediation plan within **30 days** for confirmed issues.

## Scope

In scope:

- Authentication handling in tools shipped from this repository (e.g. session
  cookie storage and OAuth helper flow in `mcp/ponymail-mcp`).
- Input validation on inputs passed to external services (PonyMail API,
  GitHub API, etc.) by tools in this repository.
- Supply-chain issues in dependencies or GitHub Actions used by this repo.

Out of scope:

- Vulnerabilities in upstream Apache services (PonyMail, GitBox, etc.) —
  please report those to the
  [ASF Security Team](https://www.apache.org/security/).
- Vulnerabilities in third-party services these tools query.

## Disclosure

We follow coordinated disclosure. Once a fix is released, we will publish a
GitHub Security Advisory crediting the reporter (unless anonymity is
requested). For issues coordinated through security@apache.org, the ASF
disclosure process applies.