# Security Policy

## Supported Versions

We actively support the following versions of fastmcp-langchain-adaptor:

| Version | Supported          |
| ------- | ------------------ |
| 0.1.x   | :white_check_mark: |

## Reporting a Vulnerability

We take security vulnerabilities seriously. If you discover a security vulnerability within fastmcp-langchain-adaptor, please send an email to security@[your-domain].com. All security vulnerabilities will be promptly addressed.

**Please do not report security vulnerabilities through public GitHub issues.**

### What to include in your report:

- Description of the vulnerability
- Steps to reproduce the issue
- Potential impact of the vulnerability
- Any suggested fixes or mitigations

### Response Timeline:

- **Acknowledgment**: Within 24 hours
- **Initial Assessment**: Within 72 hours
- **Status Update**: Weekly updates until resolved
- **Resolution**: Target 30 days for critical issues, 90 days for others

### Security Best Practices for Users:

1. **Keep Dependencies Updated**: Regularly update the package and its dependencies
2. **Input Validation**: Always validate inputs when using MCP tools in production
3. **Network Security**: Use HTTPS/TLS when connecting to MCP servers
4. **Access Control**: Implement proper authentication and authorization for MCP endpoints
5. **Logging**: Monitor and log tool executions for security auditing

### Vulnerability Disclosure Process:

1. Security researcher reports vulnerability privately
2. We confirm the vulnerability and assess impact
3. We develop and test a fix
4. We prepare a security advisory
5. We release the fix and publish the advisory
6. We credit the reporter (if desired)

Thank you for helping keep fastmcp-langchain-adaptor and our users safe!
