# Security Policy

## Reporting a vulnerability

Please report security issues through GitHub Security Advisories:

https://github.com/jmrGrav/mcp-hugo-server-go/security/advisories/new

Do not open a public issue for a potential vulnerability.

## Scope

This project handles:

- public MCP discovery
- OAuth discovery and token validation
- authenticated content read and write operations
- build and site administration actions

Reports are most useful when they include:

- the affected endpoint or tool
- the bearer scope or anonymous path used
- the exact request and response observed
- whether the issue is reproducible on the public endpoint

## Language

Preferred languages:

- French
- English

