leanix-pathfinder-mcp-server/SECURITY.md

MCP Server for LeanIX Pathfinder API - Enterprise Architecture Management Platform

# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 1.0.x   | :white_check_mark: |

## Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it responsibly:

### 🔒 Private Disclosure

1. **Do NOT** create a public GitHub issue
2. Email security concerns to: [INSERT YOUR EMAIL]
3. Include detailed information about the vulnerability
4. Allow reasonable time for response and fixing

### 📝 What to Include

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fixes (if any)
- Your contact information

### ⏱️ Response Timeline

- **Initial Response**: Within 48 hours
- **Status Update**: Within 1 week
- **Fix Timeline**: Depends on severity

### 🛡️ Security Considerations

#### Authentication
- Uses OAuth 2.0 with client credentials flow
- API tokens should be stored securely
- Automatic token refresh implemented

#### Data Handling
- No sensitive data is logged
- API responses are not cached persistently
- Environment variables for secrets

#### Network Security
- HTTPS required for production
- CORS properly configured
- Input validation on all endpoints

### 🔧 Security Best Practices

#### For Users
- Store API tokens in `.env` files (not in code)
- Use environment-specific configurations
- Regularly rotate API tokens
- Monitor API usage logs

#### For Developers
- Validate all inputs
- Use parameterized queries
- Implement proper error handling
- Keep dependencies updated

### 📊 Vulnerability Disclosure

After a vulnerability is fixed:
1. Credit will be given to the reporter (if desired)
2. A security advisory may be published
3. Users will be notified of the update

### 🆘 Emergency Contact

For critical security issues requiring immediate attention:
- Priority: Critical vulnerabilities that could lead to data exposure
- Response: Within 24 hours
- Contact: [INSERT EMERGENCY CONTACT]

Thank you for helping keep this project secure! 🔐