We provide security updates for the following versions of workspace-qdrant-mcp:

Python Compatibility: Python 3.9+ is required for security updates.

Qdrant Compatibility: Qdrant 1.7+ is required for full security feature support.

We take security vulnerabilities seriously. Please follow our responsible disclosure process:

Email: christian.berclaz@mac.com

• Use this for vulnerabilities that could be exploited maliciously
• Include "SECURITY" in the subject line
• We'll acknowledge receipt within 48 hours
• Initial assessment provided within 1 week

Use GitHub's Security Advisory system for coordinated disclosure:

1. Go to the Security tab in this repository
2. Click Report a vulnerability
3. Fill out the private security advisory form

This allows for private collaboration with our team before public disclosure.

Use our Security Issue Template for:

• Security configuration improvements
• Documentation security updates
• General security hardening suggestions

Qdrant Cloud Security:

# Use environment variables, never hardcode keys
export QDRANT_API_KEY="your-secure-key"

# For production, use secrets management
kubectl create secret generic qdrant-secret --from-literal=api-key=your-key

Local Development:

# Secure your local Qdrant instance
docker run -p 6333:6333 \
  -e QDRANT__SERVICE__HTTP__ENABLE_CORS=false \
  qdrant/qdrant

Production Deployment:

• Always use HTTPS/TLS for Qdrant connections
• Implement proper firewall rules
• Use VPN or private networks for cloud deployments

Configuration:

{
  "mcpServers": {
    "workspace-qdrant-mcp": {
      "env": {
        "QDRANT_URL": "https://your-secure-qdrant.com:6334",
        "QDRANT_API_KEY": "${QDRANT_API_KEY}"
      }
    }
  }
}

Sensitive Information:

• Never store personally identifiable information (PII) in embeddings
• Review documents before ingestion for sensitive data
• Use collection-level access controls when available

Embedding Model Considerations:

• Local models (recommended): Data stays on your system
• Cloud models: Review privacy policies for your use case

For Contributors:

• Run security tests: workspace-qdrant-test --security
• Check dependencies: pip-audit
• Validate configurations: workspace-qdrant-validate

• Input Validation: All user inputs are sanitized and validated
• Dependency Scanning: Automated vulnerability scanning in CI/CD
• Security Testing: Comprehensive security test suite
• Secure Defaults: Conservative configuration defaults

Our continuous security monitoring includes:

• Automated Dependency Updates: Via Dependabot
• Vulnerability Scanning: GitHub Security Advisories
• Code Security Analysis: CodeQL and security linting
• Third-party Security Assessment: MseeP.ai verified

# Security-focused diagnostics
workspace-qdrant-test --component security
workspace-qdrant-health --security-check
workspace-qdrant-validate --security

• GitHub Releases: Subscribe to release notifications
• Security Advisories: Watch this repository for security updates
• Changelog: Review CHANGELOG.md for security-related changes

# Check current version
workspace-qdrant-mcp --version

# Update to latest secure version
pip install --upgrade workspace-qdrant-mcp

# Verify installation
workspace-qdrant-test --quick

This security policy covers:

• workspace-qdrant-mcp package and all included tools
• Configuration templates and examples
• Documentation and setup guides
• CI/CD workflows and automation

We appreciate security researchers and contributors who help improve our security posture. Contributors who report valid security issues will be:

• Acknowledged in our security changelog (with permission)
• Credited in the GitHub Security Advisory
• Listed in our CONTRIBUTORS.md file

This security policy complements but does not replace our License. For questions about responsible disclosure or this policy, contact christian.berclaz@mac.com.

Last Updated: September 1, 2025 Next Review: December 1, 2025

For questions about this security policy, please email christian.berclaz@mac.com or open a general discussion.