Please do not report security vulnerabilities through public GitHub Issues.

Use GitHub Security Advisories to report them privately.

Include the affected version, impact, reproduction steps, and any suggested mitigation when available. Remove API keys, tokens, session data, personal information, and other secrets from logs or examples.

This policy covers the Python SDK, Server, WebUI, Desktop application, built-in tools, skills, and MCP integrations maintained in this repository.