Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them by:

1. Creating a new Issue in this repository
2. Tagging it with the "security" label
3. Or contacting the maintainer via GitHub: https://github.com/dannymaaz

Please include the following information in your report:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested fix (if any)
• Your contact information for follow-up

• Initial Response: Within 48 hours
• Status Update: Within 1 week
• Resolution: Depends on severity

1. Acknowledgment: We'll confirm receipt of your report
2. Assessment: We'll evaluate the vulnerability
3. Communication: We'll keep you informed of our progress
4. Credit: We'll acknowledge your contribution (if you wish)

• Use service accounts for production deployments
• Rotate credentials regularly
• Never commit credentials to version control

• Configure firewall rules appropriately
• Use private networking when possible
• Enable VPC Flow Logs for monitoring

• Follow principle of least privilege
• Use IAM roles instead of service account keys when possible
• Regularly audit access permissions

• Enable Cloud Logging for all operations
• Set up alerts for suspicious activities
• Review audit logs regularly

All commands executed through the MCP are validated against a blocklist of dangerous operations including:

• System modifications
• Privilege escalation attempts
• Service disruption commands
• Data destruction operations

• Sensitive values are automatically masked
• Validation prevents common misconfigurations
• Backups are created before modifications

• All operations are logged
• Logs include timestamps and operation details
• Logs are stored securely in Google Cloud Logging

1. SSH Key Management: Users must manage SSH keys securely
2. Network Access: VPS must have appropriate firewall rules
3. IAM Permissions: Requires Compute Admin and Logging Admin roles

Security updates will be released as patch versions (e.g., 1.0.1). Users are encouraged to update promptly.

• GitHub Security Advisories
• Release notes
• Email notifications for critical issues

Last Updated: 2024 Contact: https://github.com/dannymaaz