RepoContext is intentionally read-only, but it can expose repository context to MCP clients. Treat registry configuration and remote deployment as security-sensitive.

RepoContext is currently a pre-release project. Security fixes are applied to the latest code on main; no older version receives a guaranteed maintenance window yet.

Use GitHub's private vulnerability-reporting form. Do not open a public issue or pull request for an undisclosed vulnerability, and do not include live credentials or proprietary repository content.

When reporting, include the affected version, reproduction steps, impact, and any relevant path or policy configuration. We will acknowledge valid reports, investigate, and coordinate a fix before disclosure.

If the private reporting form is unavailable, contact the repository owner through the private contact method listed on their GitHub profile and mention only that you need a secure reporting channel.

Relevant issues include bypasses of sensitive-path or documentation-deny rules, working-tree or untracked-data exposure, access without the configured HTTP bearer token, path traversal, snapshot contamination, and secrets included in packaged or container artifacts.

Use repositories and credentials you own or are authorized to test. Do not test against third-party deployments, degrade service, or retain exposed data. Maintainers will coordinate disclosure after a fix is available; please avoid public discussion until that process is complete.