GeoGuessr MCP Server

# Security Policy ## Supported Versions We actively support the following versions of the GeoGuessr MCP Server: | Version | Supported | | ------- | ------------------ | | 0.1.x | :white_check_mark: | | < 0.1 | :x: | ## Reporting a Vulnerability We take the security of the GeoGuessr MCP Server seriously. If you discover a security vulnerability, please follow these steps: ### How to Report 1. **Do NOT** open a public issue for security vulnerabilities 2. Email security details to: **yuki.vachot@datasingularity.fr** 3. Include the following information: - Description of the vulnerability - Steps to reproduce the issue - Potential impact assessment - Suggested fix (if available) ### What to Expect - **Acknowledgment**: You will receive a response within 48 hours acknowledging receipt of your report - **Investigation**: We will investigate the issue and provide an initial assessment within 5 business days - **Updates**: We will keep you informed about the progress of the fix - **Resolution**: Once fixed, we will notify you and coordinate disclosure timing - **Credit**: We will credit you for the discovery (unless you prefer to remain anonymous) ## Security Best Practices ### Authentication - **Never commit** your `GEOGUESSR_NCFA_COOKIE` to version control - Use environment variables (`.env` file) for sensitive credentials - Rotate your cookies regularly - Use read-only API access when possible ### Deployment - Always use HTTPS in production environments - Keep Docker images updated with the latest security patches - Use secrets management for production deployments - Implement rate limiting on public-facing endpoints - Review and restrict container permissions ### API Usage - Monitor API usage for unusual patterns - Implement request validation and sanitization - Use the latest version of dependencies - Enable monitoring and logging for security events ## Known Security Considerations ### Authentication Token Storage The server stores authentication cookies in memory during runtime. For production use: - Ensure proper access controls on the server - Use encrypted storage if persisting credentials - Implement session timeouts ### API Monitoring The monitoring system periodically checks GeoGuessr API endpoints: - Requests are made with appropriate rate limiting - No sensitive data is logged - Schema data is stored locally without sensitive information ### Docker Security When deploying with Docker: - Use non-root user inside containers - Limit container capabilities - Use read-only root filesystem where possible - Scan images for vulnerabilities regularly ## Dependency Security We use automated tools to monitor dependencies: - Regular updates via Dependabot (recommended) - Vulnerability scanning in CI/CD pipelines - Manual security audits of critical dependencies ### Updating Dependencies ```bash # Check for security vulnerabilities pip install safety safety check # Update dependencies pip install --upgrade -e ".[dev]" ``` ## Security Checklist for Contributors Before submitting a pull request, ensure: - [ ] No hardcoded credentials or secrets - [ ] Input validation on all user-provided data - [ ] Proper error handling without information disclosure - [ ] No SQL injection vulnerabilities (if using databases) - [ ] No XSS vulnerabilities in web interfaces - [ ] Dependencies are up to date - [ ] Security tests are passing - [ ] Code follows secure coding practices ## Vulnerability Disclosure Policy We follow a coordinated disclosure policy: 1. **Private disclosure**: Vulnerabilities are reported privately 2. **Investigation period**: 90 days to develop and test a fix 3. **Coordinated release**: Fix is released with security advisory 4. **Public disclosure**: Details published after fix is available ## Security Updates Security updates are released as: - **Critical**: Immediate patch release - **High**: Release within 7 days - **Medium**: Release within 30 days - **Low**: Included in next scheduled release ## Contact For security-related questions or concerns: - **Email**: yuki.vachot@datasingularity.fr - **Response Time**: Within 48 hours --- **Last Updated**: 2025-11-29