Security fixes are made on the current 0.3.x line. The supported component surface includes the Mebular daemon, MCP server and capability API, Memory Runtime sidecar, DSH/Hermes/OpenCode host adapters, Console and the Electron desktop app.

Do not open a public issue.

Report privately through GitHub Private Vulnerability Reporting:

https://github.com/Windsander/Mebular/security/advisories/new

This opens a private advisory visible only to you and the maintainers.

• Affected version(s)
• Component: daemon, MCP/capability API, Memory Runtime sidecar, DSH/Hermes/OpenCode adapter, Console, or Electron desktop
• Runtime mode when relevant: managed, attached or manual
• Steps to reproduce
• Impact
• Proof of concept, if available

Please do not include real keys, tokens, or user data. Use redacted or synthetic examples instead.

Responses are best effort: we usually acknowledge a report within 7 days and give an initial assessment within 30 days. This is not a fixed SLA, and timelines may vary with complexity and maintainer availability.

We publish details after a fix or mitigation is available. Please give the maintainers reasonable time to respond and release a fix before disclosing publicly.

In scope:

• Mebular daemon
• MCP server and internal capability API
• Memory Runtime sidecar: lifecycle (managed/attached/manual), discovery, host/capability tokens, staging, cache, outbox/dead and model-source boundaries
• Host adapters: DSH, Hermes and OpenCode/OpenChamber
• Console
• Electron desktop app
• Sync protocol
• Authentication and authorization
• Cryptography and key handling
• Redaction and data minimization before staging, outbox, host spool, logs or remote model calls

Out of scope:

• Dependency upgrades with no demonstrated security impact
• Ordinary bugs with no security impact
• Local issues that require physical access and have no additional impact
• Physical erasure of host-owned copies (for example DSH session.v4.jsonl), provider logs or already-synced offline peers, where Mebular only promises cooperative tombstone propagation

Out-of-scope reports are welcome as regular GitHub issues.

We consider good-faith security research authorized under this policy when you:

• do not destroy, corrupt, or exfiltrate data;
• do not access, modify, or publicly disclose other people's data;
• stop testing and report promptly once you identify a vulnerability.

中文提示：安全漏洞请通过上方的 GitHub 私密报告入口提交，不要开公开 issue；报告中请勿附带真实密钥、令牌或用户数据。