docs: restore SECURITY.md, lost in the v2 tree swap - #1843
Merged
Conversation
`SECURITY.md` existed on the pre-swap `main` (ac3c1a1) and still exists on `v1/main`, but the v2 tree never had one — so #1817 silently removed the security policy from the default branch. That is the wrong file to be missing right now: it is where private vulnerability reporting is advertised, and it disappeared in the same window as 2.0.0 shipping and external pull requests being turned off (#1820). Losing the PR path and the security-report path together would leave an outside reporter with no documented route at all. Restored from `v1/main` with the additions #1820 asks for: - A supported-versions table covering all four package names — v2 supported, the v1 line security-fixes-only under the `v1-latest` dist-tag, anything below 1.0.0 unsupported. The three sub-packages are named explicitly since they exist only on v1 and are deprecated. - A note that the repository does not accept outside pull requests, but that this explicitly does NOT apply to security reports, which must go through the advisory process rather than any public channel. Without that, the new issues-only policy reads as "no way to reach us". - "Whether it affects v2, v1, or both" added to the report checklist, now that two lines are live. Verified private vulnerability reporting is enabled on the repo, so the advisory link is a working route rather than an aspiration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
This was referenced Jul 28, 2026
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1820.
The regression
SECURITY.mdexists on the pre-swapmain(ac3c1a12) and onv1/main— but the v2 tree never had one, so #1817 silently removed the security policy from the default branch.I found this while checking #1820's prerequisites, not from any alert. Nothing flagged it.
Why it matters right now
It is where private vulnerability reporting is advertised, and it vanished in the same window as 2.0.0 shipping and external pull requests being switched off.
Losing the PR path and the security-report path together would leave an outside reporter with no documented route at all — exactly the wrong gap for a tool that connects to arbitrary MCP servers.
What's restored, plus what #1820 asked for
Base content restored from
v1/main, with three additions:Supported-versions table covering all four package names:
@modelcontextprotocol/inspector@modelcontextprotocol/inspectorv1-latest-client/-server/-cliThe three sub-packages are named explicitly because they exist only on the v1 line and are deprecated — v2 ships a single package, so someone reading "is my version supported?" needs them listed.
A carve-out for security reports. The doc now states that the repo does not accept outside pull requests, and that this does not apply to security reports. Without it, the new issues-only policy reads as "no way to reach us".
"Whether it affects v2, v1, or both" added to the report checklist, now that two lines are live.
Verified
Private vulnerability reporting is enabled on the repo (
GET /repos/.../private-vulnerability-reporting→{"enabled": true}), so the advisory link is a working route rather than an aspiration.🤖 Generated with Claude Code
https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD