jmap-mcp handles access to people's mailboxes, so security reports are taken seriously.

Please do not open a public issue. Report it privately through GitHub: Security › Report a vulnerability on kOlapsis/jmap-mcp.

Include the affected version, a description of the issue, its impact and the steps to reproduce. You will get an acknowledgment within three working days. We will keep you informed while we fix it and credit you in the advisory unless you prefer otherwise.

Security fixes go into the latest minor release. Upgrade to the latest version before reporting.

In scope: the bridge itself (OAuth endpoints, token handling, the SSRF guard, the MCP tools, the HTML pages, the container image). Vulnerabilities of mail servers or MCP clients should be reported to their own projects; tell us if they affect jmap-mcp users.