Skip to content

Security: samcex/codex-powerapps-canvas

Security

SECURITY.md

Security

Credentials and tenant data

This repository must never contain:

  • Microsoft access or refresh tokens;
  • browser cookies, authorization codes, or callback URLs;
  • complete Power Apps Studio coauthoring links;
  • tenant-specific environment IDs or app IDs;
  • exported business data or production .pa.yaml source.

The plugin starts Microsoft's MCP server without tenant values. App identifiers are passed directly to the connect tool only when a user supplies a Studio URL in their trusted Codex session.

Reporting a vulnerability

Open a GitHub security advisory for vulnerabilities in this plugin. Do not include working credentials, private coauthoring links, customer data, or production app source in a report.

Issues in Microsoft.PowerApps.CanvasAuthoring.McpServer itself should also be reported through Microsoft's Power Platform support or the relevant Microsoft repository.

There aren't any published security advisories