Only the latest release published to PyPI receives security fixes.

Please do not open a public issue for security vulnerabilities.

Instead, report privately via GitHub Security Advisories ("Report a vulnerability" on the repository's Security tab).

Include:

• A description of the issue and its impact
• Steps to reproduce (a minimal repro repo or file is ideal)
• Affected version(s) and environment

You can expect an acknowledgement within 7 days. Fixes for confirmed issues are released as a patch version and credited in the advisory unless you prefer otherwise.

Things especially relevant to this project:

• Path traversal / scanning outside the requested directory — paths.py validates scan roots; bypasses are in scope.
• Command injection into scanner CLIs — engine adapters must never pass unsanitized input through a shell.
• Secret leakage in reports — findings redact matched secret values; a report that exposes full secret material is a bug.
• Vulnerabilities in the wrapped scanners themselves (gitleaks, semgrep, bandit, osv-scanner, checkov) should be reported upstream.

• Run the server with the least filesystem access your MCP host allows.
• Keep the optional scanner CLIs up to date; secscan-mcp uses whatever versions are on PATH.
• Treat scan reports as sensitive — they contain file paths and redacted secret context.