Security & Vulnerability Disclosure Policy

1. Our Commitment

Protecting the data and workloads our customers entrust to MCPCore is a core priority. We welcome reports from security researchers and users who identify potential vulnerabilities, and we are committed to investigating every valid report and resolving confirmed issues promptly.

This policy describes how to report a vulnerability, which systems are in scope, the rules that apply to security testing, and what you can expect from us in return.

2. Reporting a Vulnerability

Please send reports to [email protected] with the subject line "Security Report". A helpful report includes:

• A description of the vulnerability and its potential impact
• The affected URL, endpoint, or component
• Step-by-step instructions to reproduce the issue
• Any proof-of-concept code, requests, or screenshots
• The identifiers of any test accounts or MCP servers you used

Please do not report security issues through public channels such as social media, public issue trackers, or community forums. Our machine-readable contact information is published at /.well-known/security.txt.

3. Scope

The following systems are in scope:

• mcpcore.io: marketing website
• app.mcpcore.io: customer dashboard
• api.mcpcore.io: platform API
• *.mcpcore.io MCP endpoints, limited to servers that you created and own

The following are out of scope:

• MCP servers, tools, or custom domains owned by other customers
• Third-party services we rely on (for example, payment, email, hosting, or documentation providers); please report these to the respective vendor
• Denial-of-service, load, or stress testing of any kind
• Social engineering, phishing, or physical attacks against our team or customers
• Reports generated solely by automated scanners without a demonstrated impact
• Missing security headers, cookie flags, or email authentication records (SPF, DKIM, DMARC) without a demonstrated exploit
• Clickjacking on pages without sensitive actions, and self-XSS
• Rate-limiting observations on non-sensitive endpoints
• Vulnerabilities that require a compromised device or outdated browser

4. Testing Guidelines

When researching vulnerabilities, you must:

• Test only against accounts and MCP servers that you own. You may register up to two accounts, using an email address you control, to test access controls between accounts.
• Never access, modify, or delete data belonging to other users. If you encounter such data, stop immediately, do not retain or share it, and include the details in your report.
• Demonstrate server-side request issues using infrastructure you control only. Do not probe internal networks, cloud metadata services, or other non-public systems.
• Keep automated traffic to a minimum and never degrade the Service for other users.
• Stop testing once you have confirmed a vulnerability. Do not use it to pivot to other systems, escalate access, or maintain persistence.
• Delete any test servers, tools, and data you created once testing is complete.
• Keep the details of the vulnerability confidential until we have confirmed that it is resolved and agreed on a disclosure date.
• Comply with all applicable laws.

Activity that does not follow these guidelines, including testing outside the scope above, remains subject to our Terms of Service and Acceptable Use Policy.

5. Good-Faith Research

If you make a good-faith effort to comply with this policy, we will consider your research to be authorised, we will not treat it as a violation of our Acceptable Use Policy, and we will not initiate legal action against you in relation to it. This commitment does not apply to activity that breaches this policy or applicable law, and we cannot authorise testing of systems owned by third parties.

6. Our Response Process

After you submit a report, we will:

• Acknowledge receipt within 3 business days
• Provide an initial assessment within 10 business days
• Keep you informed of our progress toward a fix
• Prioritise remediation according to the severity and impact of the issue
• Notify you when the issue has been resolved

We follow a coordinated disclosure model. We ask that you allow us up to 90 days from the initial report to resolve an issue before any public disclosure, and we will work with you to agree on an appropriate timeline.

7. Rewards and Recognition

MCPCore does not currently operate a bug bounty program. We do not offer monetary rewards or other compensation for vulnerability reports, and submitting a report does not create any entitlement to payment.

We genuinely value the time and expertise researchers contribute. With your permission, we are happy to acknowledge validated reports that lead to a fix. We do not engage with requests for payment made as a condition of sharing or withholding vulnerability details.

8. Contact

For security reports or questions about this policy, please contact:

HAFETECH LLC
30 N Gould St Ste N
Sheridan, WY 82801, USA
Email: [email protected]