Report privately. Never open a public issue, discussion, or pull request for a security problem.

1. Preferred: on the affected repo, open the Security tab and choose Report a vulnerability (GitHub private vulnerability reporting).
2. Fallback: if that option is not available, email info@compeller.ai.

For the hosted Compeller service, including the MCP server at https://compeller.ai/api/mcp, email info@compeller.ai.

• Affected repo, and the version or commit
• What an attacker could do
• Steps to reproduce, or a proof of concept

Do not include secrets, license keys, or signing material in a report. If one is needed to reproduce the problem, say so and we will arrange a safe way to share it.

Fixes go into the latest release, or the main branch where a repo has no releases. Older versions are not patched.