If you discover a security vulnerability in vibeTeX, please report it privately — do not open a public issue.

• Preferred: use GitHub's Report a vulnerability (private security advisories) on this repository.
• Or email security@vibetex.dev with details and reproduction steps.

Please include:

• A description of the issue and its impact.
• Steps to reproduce (a minimal proof-of-concept is ideal).
• Affected version(s) and your environment.

We aim to acknowledge reports within a few days and to ship a fix or mitigation as quickly as is practical. We'll credit you in the release notes unless you prefer to remain anonymous.

vibeTeX is pre-1.0. Security fixes are applied to the latest published 0.x release on npm. Please upgrade to the newest version before reporting.

vibeTeX never stores your Overleaf password. The Git authentication token and the optional, experimental overleaf_session2 cookie you provide stay in your own environment / local MCP client config and are passed through to Overleaf's official Git bridge (and, only if you opt in, its web session). Logs are secret-redacting and never print tokens, cookies, or the OAuth passcode.

When running a public or remote deployment:

• Put the HTTP /mcp endpoint behind the built-in OAuth 2.1 + PKCE layer (VIBETEX_OAUTH_ENABLED=true) and a TLS-terminating proxy.
• Prefer VIBETEX_READ_ONLY=true so the connector cannot mutate projects.
• Generate the OAuth passcode and token secret with openssl rand -base64 24 / openssl rand -base64 32; never commit them.

The experimental session-cookie tier (Tier 4) is unofficial and ToS-grey; treat the cookie as a credential and rotate it if exposed.