If you discover a security vulnerability in Sift, please report it privately rather than opening a public issue.
Email dushyant@altslate.com with:
- a description of the issue and its impact,
- steps to reproduce, and
- any relevant logs or proof-of-concept.
We'll acknowledge your report and work with you on a fix and coordinated disclosure.
Sift runs a local HTTP server bound to 127.0.0.1 and an MCP endpoint at
/mcp (which rejects non-localhost Origins to guard against DNS rebinding).
Reports about the local server, the MCP surface, or the way repository content
is read/served are especially welcome.