Security fixes are applied to the current minor release on main. Older minors are not maintained.

Please do not open a public GitHub issue for a suspected vulnerability.

Use one of:

1. GitHub Security Advisories — private report form.
2. Email the maintainer: federico.cesconi@sandsiv.com, subject prefixed [bettercallclaude security].

Please include, as available:

• Which component (plugin manifest, privacy hook, an MCP server — which one, HTTP vs STDIO). Note that MCP server source lives in the separate fedec65/BetterCallClaudeMCP repo since v4.4.0; only the local ollama STDIO server is bundled here.
• The commit or release version you tested against.
• Reproduction steps: prompt, tool call, inputs, network transcript.
• Observed impact: data that left the machine, confirmation bypassed, agent coerced into a tool it does not list, etc.
• Your assessment of severity and blast radius.

"Critical" here means privileged content exfiltration (the whole Anwaltsgeheimnis protection promise), remote code execution in any MCP server, or authentication bypass on the hosted gateway.

In scope:

• The plugin manifest, hooks, agents, commands, skills in bettercallclaude/.
• The local ollama STDIO server bundled at bettercallclaude/mcp-servers/ollama/.
• The seven remote HTTP MCP servers and the HTTP ingress gateway that serves mcp.bettercallclaude.ch — source in fedec65/BetterCallClaudeMCP.

Out of scope:

• Cowork Desktop itself — report to Anthropic.
• The Anthropic API — report to Anthropic.
• Public Swiss legal sources the plugin queries (entscheidsuche.ch, fedlex.admin.ch, etc.).
• Anything hosted on the swiss-caselaw SSE endpoint (see that project's security policy).

We prefer coordinated disclosure. By default, the maintainer will keep a report private until a fix is released, then publish a GitHub Security Advisory and credit the reporter (unless anonymity is requested).

When the project accumulates meaningful reports, reporters who want public credit will be listed here.

These items look like bugs but are intentional:

• Lint warnings in the MCP servers. @typescript-eslint/no-explicit-any and unused-var warnings are tracked separately and do not fail CI. They are not security issues.
• The pre-tool-use hook uses regex, not ML. This is a design choice explained in docs/PRIVACY.md §2. The hook reduces accidental leakage; it is not a guarantee.
• Seed data at data/bettercallclaude.db. Public legal references, no PII. See docs/PRIVACY.md §3.