Do not open a public issue for vulnerabilities that could expose credentials, private campaign data, GM-only content, arbitrary files, or remote execution. Use GitHub's Report a vulnerability flow on the affected repository; private vulnerability reporting is enabled for all nine active SagaSmithAI repositories. If the repository UI reports that private reporting is unavailable, contact the organization through the email address published on the SagaSmithAI GitHub profile and include only the minimum details needed to establish a private channel.

Secret scanning, push protection, and Dependabot security updates are enabled on the same repositories. Provider-pattern scanning is enabled; non-provider pattern and validity checks remain disabled where the current GitHub plan does not expose them. These settings are defense-in-depth and do not replace the private reporting path.

The current default branch of each active repository receives security fixes. Tagged releases may receive fixes when they are still used by the current platform, but there is no long-term support promise yet.

• MCP stdio servers are intended for trusted local execution. Remote HTTP/SSE adapters require explicit authentication, origin policy, and network allowlists.
• SagaSmith Web in SagaSmith-Web is an Internet-facing browser product and orchestration layer. Account, room, identity, object-storage, internal-service, quota, and Agent credentials must remain server-side, and every domain action must be re-authorized by the target MCP.
• Agent-supplied principal identifiers are not trusted. Hosts must inject a principal derived from the authenticated channel, and MCP servers must enforce campaign and actor grants.
• Browser, channel, and provider tokens must never be passed through to a domain MCP. Hosted callers use short-lived, target-audience delegations that keep caller/workload, requester, resource owner, acting host/character, allowed operation, room turn, base revision, and expiry distinct. Each HTTP request is authorized independently.
• A server-issued handle is an opaque state name, not a capability. Servers must bind handles to an owner and expiry, re-authorize every use, and return a safe recoverable error for expired or mismatched handles. Transport sessions and connection-pool identity are never authority.
• Player-visible responses must not contain GM-only rules, scenes, hidden combatants, private actor knowledge, or another branch's state.
• Imported PDFs, rulebooks, modules, templates, and skill assets are untrusted input. Enforce allowlisted roots, size/type limits, content-addressed storage, and provenance.
• Never submit provider keys, bot tokens, local config files, campaign databases, Chroma stores, imported commercial content, or generated artifacts containing private play data.
• Public repository visibility is not evidence that a Content Pack or embedded asset may be redistributed; report accidental publication of restricted source material privately.

Security fixes should include a regression test that demonstrates the prior boundary failure without publishing sensitive production data.