mdpact is pre-1.0. Only the latest release receives security fixes.

Do not open a public GitHub issue for security reports.

Email the maintainers at security@mdpact.dev (placeholder — will be wired up before v1.0 launch). Include:

• A description of the issue
• Steps to reproduce
• Impact assessment if known
• Your disclosure preferences

We aim to acknowledge reports within 3 business days and to coordinate a fix within 90 days. Credit will be given in the release notes unless you ask to remain anonymous.

• The mdpact CLI and all @mdpact/* packages
• The mdpact GitHub Action (once shipped)
• The hosted website and docs (once shipped)

• Behavior of third-party model APIs the engine calls
• Security of user-provided MCP servers referenced from a spec