# Security Policy

## Supported Versions

Security fixes land on the latest release of `obsidian-mcp-server`. Older
versions are not patched — upgrade to the current release.

## Reporting a Vulnerability

Please do not open a public issue for security reports. Instead:

- Report privately via GitHub: **Security** tab → **Report a vulnerability**, or
- Email **security@caseyjhand.com**

Include a minimal reproduction where possible. You'll receive an
acknowledgment within a few days, and credit in the release notes if the
report leads to a fix (unless you prefer otherwise).