# Security Policy

## Supported Versions

This project follows semantic versioning. During 0.x (alpha) releases, we
generally support the latest minor release for security fixes. Older versions
may receive fixes at the maintainers’ discretion.

## Reporting a Vulnerability

Please report security issues responsibly and privately.

- Preferred: Open a private security advisory in GitHub
  - https://github.com/mkellerman/bmad-mcp-server/security/advisories/new
- Alternative: If you cannot use GitHub Advisories, open a minimal public
  issue without sensitive details and a maintainer will reach out to you.

We aim to acknowledge valid reports within 2 business days and provide a
timeline for remediation after triage. We may coordinate disclosure and
release a patch before public disclosure.

## Scope

Vulnerabilities affecting the integrity, confidentiality, or availability of
the MCP server or its embedded content are in scope. Issues that are clearly
non-security bugs can be reported via regular GitHub issues.

