Skip to content

docs(security): record why the open advisories are unreachable here #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
CDVolvik wants to merge 1 commit into
base: master
Choose a base branch
from
Open

docs(security): record why the open advisories are unreachable here #58

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,24 @@ part of its design, not an afterthought:
- **Secrets via env only.** The private key is provided through `PF_PRIVATE_KEY`
and validated at startup; it is never committed and is gitignored.

## Dependency advisories

Open Dependabot alerts on this repository are, as of 0.4.0, all transitive
through `@modelcontextprotocol/sdk`'s HTTP transport dependencies: `hono`, and
`ip-address` by way of `express-rate-limit`.

This server only ever constructs a `StdioServerTransport`. It never instantiates
an HTTP or SSE transport, so that code neither runs nor ships — the published
bundle contains no reference to any of those packages. Check it yourself:

```bash
pnpm build
grep -c -E "hono|express-rate-limit|ip-address" dist/index.js # 0
```

Reachability is a reason not to panic, not a reason to skip the bump. Advisories
are still cleared as the SDK ships updated dependencies.

## Deployer responsibilities

You, the deployer, are the covered entity or business associate. You are
Expand Down