obsidian-plugin/aaronsb_obsidian-mcp-plugin
1
0
Fork 0
mirror of https://github.com/aaronsb/obsidian-mcp-plugin.git synced 2026-07-22 16:40:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
aaronsb_obsidian-mcp-plugin/SECURITY.md
Aaron Bockelie 36301118a9 docs: Add comprehensive project documentation and security audit 
- Add CONTRIBUTING.md with development guidelines
- Add SECURITY.md with vulnerability reporting policy
- Create GitHub issue templates for bugs and features
- Add PR template with checklist
- Set up GitHub Actions for testing and security scanning
- Document all security findings from code audit
- Create detailed GitHub issues for all vulnerabilities
- Update CHANGELOG with security audit results
- Add project structure documentation

This establishes proper open-source project structure and documents
all critical security issues that need to be addressed.

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-12 00:14:45 -05:00

1.8 KiB
Raw Blame History

Security Policy

Reporting Security Vulnerabilities

We take security seriously. If you discover a security vulnerability, please:

  1. DO NOT open a public issue
  2. DO report it via GitHub Security Advisories: Report a vulnerability
  3. OR email details to the maintainer (check commit history for email)

What to Include

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

Known Security Issues

We're actively working on fixing these security vulnerabilities:

Issue Status Priority
No authentication on MCP server 🔧 In Progress CRITICAL
Path traversal in file operations 📋 Planned CRITICAL
Missing input validation 📋 Planned HIGH
Insecure session management 📋 Planned HIGH

See our security issues for details.

Security Best Practices

Until security improvements are complete:

  1. Only use on trusted networks (localhost only)
  2. Don't expose the MCP port to the internet
  3. Monitor vault access for unexpected changes
  4. Keep backups of your vault
  5. Review plugin permissions in Obsidian

Secure Configuration

{
  "httpEnabled": true,
  "httpPort": 3001,  // Change from default
  "autoDetectPortConflicts": true,
  "debugLogging": false  // Disable in production
}

Future Security Enhancements

  • API key authentication
  • Path validation framework
  • Input sanitization
  • Rate limiting
  • Audit logging
  • Encrypted sessions

Acknowledgments

Thanks to security researchers who responsibly disclose vulnerabilities.