We only provide security updates for the latest minor release of the current major version.

⚠️ Please do NOT open a public GitHub issue for security vulnerabilities.

1. Email: Send a detailed report to the maintainers via GitHub Security Advisories
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Suggested fix (if you have one)

We aim to handle all reports promptly. If you don't hear back within 48 hours, please follow up.

• You will be credited in the release notes (unless you prefer anonymity)
• A CVE will be requested for significant vulnerabilities
• The fix will be released as a patch version

• SQL injection in SQLite queries
• Path traversal in file operations
• Arbitrary code execution via crafted input
• Information disclosure of files outside project root
• Denial of service through resource exhaustion
• Dependencies with known vulnerabilities (in dependencies, not devDependencies)

• Issues in third-party AI agents (Claude, Cursor, etc.)
• Vulnerabilities requiring physical access to the machine
• Social engineering attacks
• Issues in the MCP protocol itself (report to MCP maintainers)
• Denial of service via extremely large codebases (expected behavior to be slow)

• Keep AI Mind Map updated to the latest version
• Do not expose the MCP server to untrusted networks (it uses stdio transport)
• Review .mindmap.json configuration in shared/public repositories
• The SQLite database (.mindmap/mindmap.db) may contain code snippets — treat it as sensitive

We regularly audit dependencies using npm audit. Critical vulnerabilities in dependencies are patched or mitigated within 7 days of disclosure.