Only the latest main branch is supported. Please ensure you are running the latest revision of any tool from this repository before reporting vulnerabilities.

Please do not open public GitHub issues for security vulnerabilities.

Two channels exist for this repository:

1. The ASF Security Team at security@apache.org (process) — preferred for any vulnerability that could affect ASF infrastructure or projects in production.
2. GitHub private vulnerability reporting for this repository ("Security" tab → "Report a vulnerability") — appropriate for issues isolated to the tooling here (e.g. the mcp/ponymail-mcp server, the activity / highlights scripts).

When in doubt, prefer security@apache.org.

We aim to acknowledge reports within 5 business days and provide a fix or remediation plan within 30 days for confirmed issues.

In scope:

• Authentication handling in tools shipped from this repository (e.g. session cookie storage and OAuth helper flow in mcp/ponymail-mcp).
• Input validation on inputs passed to external services (PonyMail API, GitHub API, etc.) by tools in this repository.
• Supply-chain issues in dependencies or GitHub Actions used by this repo.

Out of scope:

• Vulnerabilities in upstream Apache services (PonyMail, GitBox, etc.) — please report those to the ASF Security Team.
• Vulnerabilities in third-party services these tools query.

We follow coordinated disclosure. Once a fix is released, we will publish a GitHub Security Advisory crediting the reporter (unless anonymity is requested). For issues coordinated through security@apache.org, the ASF disclosure process applies.