If you believe you have found a security vulnerability in @imqueue/mcp (or any @imqueue/* package), please report it privately — do not open a public issue, pull request, or discussion for it.

Two private channels:

• GitHub — use Security → Report a vulnerability on this repository to open a private advisory (preferred; it keeps the report and the fix coordinated in one place).
• Email — support@imqueue.com with the details below.

Please include:

• the affected package and version(s);
• a description of the issue and its impact;
• steps to reproduce, or a proof of concept, where possible.

• We aim to acknowledge a report within a few business days.
• We'll confirm the issue, keep you updated on progress, and coordinate a fix and a disclosure timeline with you.
• Once a fix is released we'll credit the reporter in the advisory unless you prefer to remain anonymous.

Security fixes land on the latest published release line of each @imqueue/* package on npm. Please make sure you can reproduce an issue against the current release before reporting.

@imqueue/mcp runs locally over stdio and only ever fetches imqueue.org for documentation. It has no hosted endpoint and collects no telemetry. See the safety model for the full trust boundary.

The @imqueue framework is open source under GPL-3.0. This policy covers the code in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be reported to those projects, though we're glad to help coordinate an upgrade.