Title: Add SDK vulnerability disclosure process and stdio trust boundary to SECURITY.md by localden · Pull Request #2973 · modelcontextprotocol/modelcontextprotocol · GitHub
Open Graph Title: Add SDK vulnerability disclosure process and stdio trust boundary to SECURITY.md by localden · Pull Request #2973 · modelcontextprotocol/modelcontextprotocol
X Title: Add SDK vulnerability disclosure process and stdio trust boundary to SECURITY.md by localden · Pull Request #2973 · modelcontextprotocol/modelcontextprotocol
Description: Adds the SDK vulnerability disclosure process and the stdio transport trust boundary to SECURITY.md, and adds a community docs page at /community/security so the policy is discoverable from the docs site. The stdio section documents that stdio peers run with equivalent privilege and the SDK does not defend either against the other. Reports whose only impact is one stdio peer denying service to the other are out of scope for GHSA/CVE and should be filed as regular issues. The same code reachable via a remote transport remains in scope. The SDK disclosure section documents that reports go to GHSA on the affected SDK repository, with maintainers coordinating across SDKs to determine which are impacted before publishing, and discussing spec-level root causes with the specification maintainers. The new docs/community/security.mdx page summarizes the policy for the docs site and links back to SECURITY.md as the canonical reference.
Open Graph Description: Adds the SDK vulnerability disclosure process and the stdio transport trust boundary to SECURITY.md, and adds a community docs page at /community/security so the policy is discoverable from the doc...
X Description: Adds the SDK vulnerability disclosure process and the stdio transport trust boundary to SECURITY.md, and adds a community docs page at /community/security so the policy is discoverable from the doc...
Opengraph URL: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2973
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:687f6b30-3a18-cb2a-d72c-3c0c1db18435 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | BD9C:3C53EF:C29777:1072D77:6A5EF93D |
| html-safe-nonce | 8d2d1fb59f9660fc45ba8468a57ae134969fd4acc4149da9be3b061e68e8af01 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJCRDlDOjNDNTNFRjpDMjk3Nzc6MTA3MkQ3Nzo2QTVFRjkzRCIsInZpc2l0b3JfaWQiOiIzMDk1NzIwNjQwOTk1MzI2MjY5IiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0= |
| visitor-hmac | 7192e190feb41db74825c387c5f01ae56cb971e29255ed43cc34e4359b130ecd |
| hovercard-subject-tag | pull_request:3928909452 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2973/files |
| twitter:image | https://avatars.githubusercontent.com/u/53200638?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/53200638?s=400&v=4 |
| og:image:alt | Adds the SDK vulnerability disclosure process and the stdio transport trust boundary to SECURITY.md, and adds a community docs page at /community/security so the policy is discoverable from the doc... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 82d0004a35927bdb00c652a57f456c55aa0eda4ade1bc7956d7510fdea6e454b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelcontextprotocol/modelcontextprotocol git https://github.com/modelcontextprotocol/modelcontextprotocol.git |
| octolytics-dimension-user_id | 182288589 |
| octolytics-dimension-user_login | modelcontextprotocol |
| octolytics-dimension-repository_id | 862570523 |
| octolytics-dimension-repository_nwo | modelcontextprotocol/modelcontextprotocol |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 862570523 |
| octolytics-dimension-repository_network_root_nwo | modelcontextprotocol/modelcontextprotocol |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | d2d913dd727d2d7ac189fb4d05b10bc34ecd03ee |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width