Universal Crypto MCP

# Security Policy ## Supported Versions | Version | Supported | | ------- | ------------------ | | 1.x.x | ✅ Active support | | < 1.0 | ❌ No support | ## Reporting a Vulnerability We take security seriously. If you discover a security vulnerability in Plugin Delivery or any Universal Crypto MCP component: ### Do NOT - Open a public GitHub issue - Post about it on social media - Exploit the vulnerability ### Do 1. **Email:** Send details to security@nirholas.io 2. **Include:** - Description of the vulnerability - Steps to reproduce - Potential impact - Any suggested fixes ### Response Timeline - **24 hours:** Initial acknowledgment - **72 hours:** Preliminary assessment - **7 days:** Detailed response with fix timeline - **30 days:** Public disclosure (coordinated) ### Scope This policy covers: - `@nirholas/plugin-sdk` - `@nirholas/chat-plugins-gateway` - plugin.delivery website - Official Universal Crypto MCP plugins ### Out of Scope - Third-party plugins - Vulnerabilities in dependencies (report to upstream) - Social engineering attacks ## Security Best Practices for Plugin Developers ### Manifest Security ```json { "api": [ { "url": "https://your-secure-api.com/endpoint", // Always use HTTPS } ] } ``` ### API Security - Validate all inputs - Use rate limiting - Implement proper CORS - Never expose secrets in client-side code ### Data Handling - Don't store sensitive user data - Use encryption for any stored data - Follow data minimization principles --- Thank you for helping keep Universal Crypto MCP secure! 🛡️