obsidian-plugin/ebullient_obsidian-deck-notes
1
0
Fork 0
mirror of https://github.com/ebullient/obsidian-deck-notes.git synced 2026-07-22 06:40:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
ebullient_obsidian-deck-notes/SECURITY.md
Erin Schnabel cedca2173d
🎨 Plugin lint
2025-11-17 22:09:55 -05:00

1.3 KiB
Raw Blame History

Security Policy

I only support the latest version of this plugin. Given the rapid evolution of the MCP protocol and dependencies, running/maintaining older versions isn't feasible.

Security Considerations

This plugin runs a local HTTP server on your machine to expose vault access via the MCP protocol:

  • Network exposure: The server listens on localhost by default but supports CORS for remote access (e.g., via Tailscale)
  • Authentication: Currently there is no authentication mechanism - any client that can reach the configured port can access your vault
  • Data privacy: All data stays on your machine; the plugin does not connect to external services or collect telemetry
  • Bridge script: The mcp-bridge.js script runs as a Node.js process and bridges stdio to HTTP

Reporting a Vulnerability

Please report suspected security issues privately using GitHub's "Report a vulnerability" link in the repository sidebar.

Do not open a public issue for suspected vulnerabilities.

When reporting, please include:

  • A description of the issue and affected versions
  • Steps to reproduce (ideally a minimal proof-of-concept)
  • Assessment of potential impact (network exposure, data access, etc.)
  • Your contact information
  • Any specific requests, such as anonymity for you and/or the organization you represent