From 7a12c5747df982cd051612beca48de922af27797 Mon Sep 17 00:00:00 2001 From: CakeRepository Date: Sun, 4 Oct 2026 02:03:46 -0500 Subject: [PATCH] docs: add SECURITY.md with public vulnerability reporting policy Security reports are handled in public GitHub issues so anyone can review and help fix them. Documents what a useful report contains, asks reporters to redact real tokens and op:// references, and describes how confirmed issues are released and credited. Linked from the README's Security & privacy section. Co-Authored-By: Claude Opus 5.5 --- README.md | 1 + SECURITY.md | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 SECURITY.md diff --git a/README.md b/README.md index 25453fa..230a956 100644 --- a/README.md +++ b/README.md @@ -270,6 +270,7 @@ Prefer `argv` over a shell `command` string when you can — fewer quoting surpr - **Token = master key** — Scope the service account tightly; rotate immediately if leaked; never commit tokens or MCP configs with secrets. - **Prefer references** — `op://…` + `op_run` beat pasting passwords into prompts or files. - **Least privilege** — Dedicated automation vaults beat sharing your whole account. +- **Reporting vulnerabilities** — Open a public issue; see [SECURITY.md](SECURITY.md). --- diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..ad21a3c --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,22 @@ +# Security Policy + +## Reporting a vulnerability + +Security issues in this project are handled **in public**. Please open a [GitHub issue](https://github.com/CakeRepository/1Password-MCP/issues/new) with the full details so anyone can review the report and help fix it. + +A useful report includes: + +- **Affected version** — the `@takescake/1password-mcp` version you tested. +- **Impact** — what an attacker, a malicious prompt, or a crafted tool call can achieve. +- **Reproduction** — minimal steps, tool inputs, or a failing test. +- **Suggested fix** — optional. Pull requests are welcome. + +**Never include real secrets.** Redact service account tokens, real `op://` references, and any revealed values before posting. If a token was exposed while testing, rotate it in 1Password. + +## Supported versions + +Fixes ship in the latest release only. Upgrade to the newest `4.x` to stay patched. + +## After a fix + +Confirmed vulnerabilities are fixed in a patch release, listed under **Security** in [CHANGELOG.md](CHANGELOG.md), and published as a GitHub Security Advisory crediting the reporter.