We actively maintain and provide security updates for the following versions:

Please do not report security vulnerabilities through public GitHub issues.

Send security issues directly to: security@leadmagic.io

Include the following information:

• 📋 Description of the vulnerability
• 🔄 Steps to reproduce the issue
• 📊 Impact assessment (who/what is affected)
• 🛠️ Suggested fix (if you have one)
• 🔗 Related files/code sections
• 📧 Your contact information

• 24 hours: Initial acknowledgment
• 72 hours: Initial assessment and severity classification
• 7 days: Detailed response with remediation plan
• 30 days: Target resolution for high/critical issues

We appreciate responsible disclosure and will:

• 📝 Credit you in our security advisories (if desired)
• 🎁 Provide LeadMagic credits for valid vulnerabilities
• 🏆 Recognition in our hall of fame

✅ Do:

• Store API keys in environment variables
• Use .env files for local development (never commit them)
• Rotate API keys regularly
• Use separate keys for different environments
• Monitor API key usage in your dashboard

❌ Don't:

• Hardcode API keys in source code
• Share API keys in chat/email
• Commit .env files to version control
• Use production keys in development
• Log API keys in application logs

✅ Recommended:

• Use HTTPS for all API communications
• Implement request timeout limits
• Use firewall rules to restrict outbound connections
• Monitor API usage and rate limits
• Implement proper error handling to avoid information leakage

✅ MCP Client Security:

• Never expose API keys to client-side code
• Run MCP server in secure environments only
• Use least-privilege access principles
• Regularly update MCP client applications
• Monitor MCP server logs for suspicious activity

✅ Secure Configuration:

# ✅ Good - Environment variable
export LEADMAGIC_API_KEY="your-secure-api-key"

# ✅ Good - .env file (not committed)
LEADMAGIC_API_KEY=your-secure-api-key

# ❌ Bad - Hardcoded in code
const apiKey = "lm_1234567890abcdef"; // NEVER DO THIS

Input Validation:

• All inputs validated with Zod schemas
• Type-safe TypeScript implementation
• Sanitized error messages
• Request size limits

Network Security:

• HTTPS-only API communication
• Configurable timeout settings
• Automatic retry with exponential backoff
• User-agent identification

Error Handling:

• No sensitive data in error messages
• Sanitized stack traces
• Proper HTTP status codes
• Logged security events

Data Handling:

• No persistent storage of sensitive data
• Minimal data retention
• Secure API communication
• GDPR compliance considerations

Privacy:

• No personal data logging
• Configurable debug levels
• Optional request/response logging
• Data minimization principles

Risk: API keys in environment variables can be accessed by any process Mitigation:

• Use secure environment variable management
• Restrict process access permissions
• Monitor environment variable access

Risk: API requests could be intercepted Mitigation:

• Always use HTTPS (enforced by default)
• Implement certificate pinning if needed
• Use VPN for sensitive environments

Risk: API abuse or DoS attacks Mitigation:

• Built-in rate limiting respect
• Configurable timeout settings
• Monitor API usage patterns

• API keys stored securely (environment variables)
• No sensitive data in logs
• Input validation implemented
• Error handling doesn't leak information
• Dependencies regularly updated
• Security tests included

• Secure environment configuration
• Network access properly restricted
• Monitoring and alerting configured
• Regular security updates applied
• Access logs monitored
• Backup and recovery plans tested

• API keys rotated regularly
• Usage monitored in dashboard
• Secure development environment
• Latest version installed
• Security advisories subscribed

1. 🛑 Stop: Don't continue using potentially compromised systems
2. 🔒 Secure: Rotate API keys immediately
3. 📧 Report: Contact security@leadmagic.io
4. 📋 Document: Save logs and evidence
5. ⏰ Monitor: Watch for unusual activity

1. 📧 Acknowledgment: We'll confirm receipt within 24 hours
2. 🔍 Investigation: Assess impact and scope
3. 🛠️ Mitigation: Implement immediate fixes
4. 📢 Communication: Update affected users
5. 📝 Post-mortem: Document lessons learned

• LeadMagic Security Center
• API Security Best Practices
• MCP Security Guidelines

• API Key Management
• Usage Monitoring
• Security Alerts

• 🚨 Security Issues: security@leadmagic.io
• 💬 General Support: support@leadmagic.io
• 💬 Community: Discord

This security policy is reviewed and updated regularly. Check back for the latest security guidance and best practices.

Last Updated: June 27, 2025 Version: 1.0.0

🛡️ Security is a shared responsibility. Thank you for helping keep LeadMagic MCP Server secure!