# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 1.x (latest) | ✅ |
| < 1.0 | ❌ |

## Reporting a Vulnerability

Do **not** open a public GitHub issue for security vulnerabilities.

Report security issues via [GitHub Issues](https://github.com/hope1026/weppy-roblox-mcp/issues/new) with the title prefixed `[SECURITY]`, or contact the maintainer via [GitHub Discussions](https://github.com/hope1026/weppy-roblox-mcp/discussions).

We will respond within 72 hours and aim to release a fix within 14 days for confirmed vulnerabilities.

## Scope

- MCP server HTTP bridge (localhost:3002)
- Plugin authentication and session token handling
- License server communication

## Out of Scope

- Roblox Studio itself
- Third-party AI client security
- Issues requiring physical access to the machine
