Only the latest release receives security fixes.

Please do not open a public issue. Report it privately through GitHub security advisories. You can expect an acknowledgement within a few days.

code-audit-mcp is read-only on the audited project: it must never write to it, and secrets found in scans must never appear in tool output. Reports that break either guarantee are treated as high priority.