We take security seriously. If you discover a security vulnerability, please report it responsibly.

Please use GitHub's private vulnerability reporting:

• Go to the Security tab
• Click "Report a vulnerability"

This ensures the report stays private until a fix is available.

• Initial response: Within 72 hours
• Patch/mitigation: Within 14 days for critical issues

⚠️ For MCP Server Salesforce users:

• NEVER commit credentials or .env files
• ALWAYS use Salesforce Sandbox environments for testing
• NEVER test with production Salesforce data
• All SOQL inputs are sanitized to prevent injection

Please do not publicly disclose vulnerabilities until we've had a chance to address them.