Please report suspected Synapse vulnerabilities through GitHub private vulnerability reporting. You can also open the repository’s Security → Advisories page and choose Report a vulnerability. Sign in to GitHub to submit a report privately to the maintainers.

Include:

• The affected Synapse, PHP, Laravel, and Laravel AI SDK versions, plus Laravel MCP and server/runtime versions where relevant.
• A description of the vulnerability and its potential impact.
• Reproduction steps or a minimal proof of concept, with any necessary configuration.

Remove API keys, credentials, private prompts, and customer data from examples and logs. Do not disclose vulnerability details in public issues or pull requests. Use the private report to coordinate investigation, fixes, and disclosure with the maintainers.

This policy does not promise a response or resolution deadline. For ordinary bugs and feature requests, use GitHub Issues.