Note: For the full security policy, see SECURITY.adoc.

We take security seriously. If you discover a security vulnerability:

1. For critical vulnerabilities: Contact the maintainer directly
2. For non-critical issues: Open an issue with [SECURITY] prefix

• Acknowledgement: Within 24 hours
• Initial assessment: Within 72 hours
• Resolution: 7-30 days depending on severity

• All database credentials must be provided via environment variables
• This server is designed for trusted environments (AI assistants/MCP clients)
• SQL-based adapters accept raw queries - ensure proper access controls