# Security Policy

This project's security policy lives in [`.github/SECURITY.md`](.github/SECURITY.md).

- **Report vulnerabilities** via [GitHub Security Advisories](https://github.com/vaquarkhan/mcp-test-harness/security/advisories/new) (do not open a public issue).
- **CRA / coordinated disclosure** guidance: see [`.github/SECURITY.md`](.github/SECURITY.md).
- **Product security testing** (CI gates, payloads, manifest rug-pull): [docs/SECURITY_TESTING.md](docs/SECURITY_TESTING.md) · [Documentation handbook](docs/HANDBOOK.md).