Only the latest released version of each package receives security updates.

Please do not open a public issue. Instead, use GitHub's private vulnerability reporting to submit a description, reproduction steps, and affected package(s). You can expect a response within 72 hours.

• CodeQL and Snyk scan every push and PR for vulnerabilities
• Rate limiting on the agent API via slowapi
• Read-only mode (ROSSUM_MCP_MODE=read-only) to disable all write operations
• Schema content validation before API submission (strips invalid values, coerces types)
• CORS restricted to allowed origins

For package-specific security details, see rossum-mcp/SECURITY.md.

Never commit tokens or secrets. Use environment variables or a .env file (gitignored).

export ROSSUM_API_TOKEN="your-token"
export ROSSUM_API_BASE_URL="https://api.elis.rossum.ai/v1"