From 942d0386a5392ddf4023c719bf8df2c0ee01f5a5 Mon Sep 17 00:00:00 2001
From: CDVolvik <216217755+CDVolvik@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:51:54 -0700
Subject: [PATCH] docs(security): record why the open advisories are
 unreachable here

Seven Dependabot alerts are open against the default branch, one of them
high. All seven are transitive through @modelcontextprotocol/sdk:

  sdk -> @hono/node-server -> hono            (4)
  sdk -> express-rate-limit -> ip-address     (3, incl. the high SSRF one)

They are production-tree dependencies, not dev-only, so dismissing them as
dev noise would be wrong. What makes them unreachable is the transport:
src/index.ts only ever constructs StdioServerTransport, never an HTTP or
SSE one, so none of that code is loaded or bundled. Verified against a
fresh build - dist/index.js has zero matches for any of the three.

Adds a Dependency advisories section to SECURITY.md with the reasoning and
a two-line command so a reader can confirm it rather than take it on faith.

States explicitly that reachability is a reason not to panic, not a reason
to skip the bump, so this does not become a standing excuse to stop
patching.

Docs only. No dependency, behaviour, or tool-surface change.
---
 SECURITY.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/SECURITY.md b/SECURITY.md
index 70bbc70..30985b3 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -29,6 +29,24 @@ part of its design, not an afterthought:
 - **Secrets via env only.** The private key is provided through `PF_PRIVATE_KEY`
   and validated at startup; it is never committed and is gitignored.
 
+## Dependency advisories
+
+Open Dependabot alerts on this repository are, as of 0.4.0, all transitive
+through `@modelcontextprotocol/sdk`'s HTTP transport dependencies: `hono`, and
+`ip-address` by way of `express-rate-limit`.
+
+This server only ever constructs a `StdioServerTransport`. It never instantiates
+an HTTP or SSE transport, so that code neither runs nor ships — the published
+bundle contains no reference to any of those packages. Check it yourself:
+
+```bash
+pnpm build
+grep -c -E "hono|express-rate-limit|ip-address" dist/index.js   # 0
+```
+
+Reachability is a reason not to panic, not a reason to skip the bump. Advisories
+are still cleared as the SDK ships updated dependencies.
+
 ## Deployer responsibilities
 
 You, the deployer, are the covered entity or business associate. You are