Please do not open a public GitHub issue for security problems. Report it privately through GitHub's Report a vulnerability button on this repository's Security tab, with a description, the affected endpoint or tool, and steps to reproduce. We will keep you updated until it is resolved.

In scope: the hosted server (https://mcp.reactvision.xyz/viro), including its OAuth behaviour and every tool it exposes, and the code in this repository.

Out of scope: denial of service by volume, and findings that require a compromised ReactVision account.

Only the deployed main branch is supported.