mead holds conversations and can reach the tools of the person who runs it, so security reports are welcome and taken seriously.
Reporting a vulnerability
Report it privately through GitHub security advisories. Do not open a public issue, and never include a real token or API key in a report.
Please include what you found, the smallest way to reproduce it, and the version or commit you tested. This is a personal project, so there is no guaranteed response time, but a report is read as soon as possible.
What is in scope
- Running an MCP tool the policy does not allow, or skipping a permission request.
- Reaching the MCP server or the deck endpoint without the bearer token.
- A token, an API key or a tool argument showing up in a log, an error message or the event log.
- A local turn being sent to a cloud provider.