Scope: This document is the vulnerability-reporting policy — how to report a security issue, supported versions, and what to expect. For the technical threat model and security design (what the tool defends against, the controls behind it, and where each lives in the source), see docs/SECURITY.md.
altium-designer-mcp is designed to work with local Altium Designer libraries. We take security seriously — particularly around file system access and input validation.
Key security properties:
- The MCP server only accesses paths configured by the user
- Path traversal attacks are prevented
- Invalid inputs return clear error messages without exposing internals
| Version | Supported |
|---|---|
| 1.x.x | Yes |
| 0.x.x | No — upgrade to 1.x |
We maintain security updates for the current major version and, once there is one, the previous major version. The 0.x pre-releases are not supported.
Please do NOT report security vulnerabilities through public GitHub issues.
-
Preferred: Use GitHub Security Advisories to report vulnerabilities privately.
-
Alternative: Email the repository owner directly at matejg03@gmail.com.
When reporting a vulnerability, please include:
- A clear description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Any suggested fixes (optional but appreciated)
| Severity | Examples |
|---|---|
| High | Arbitrary file access outside configured library paths |
| High | Path traversal vulnerabilities |
| Medium | Denial of service vulnerabilities |
| Medium | Information disclosure (file paths, system info) |
| Low | Issues requiring local access or unlikely scenarios |
| Action | Timeframe |
|---|---|
| Initial acknowledgement | Within 48 hours |
| Preliminary assessment | Within 1 week |
| Fix development | Depends on severity and complexity |
| Security advisory publication | After fix is available |
-
Acknowledgement: We will acknowledge receipt of your report within 48 hours.
-
Communication: We will keep you informed of our progress and may ask for additional information.
-
Credit: Unless you prefer to remain anonymous, we will credit you in our security advisory and release notes.
-
Disclosure: We follow responsible disclosure practices. We ask that you give us reasonable time to address the issue before any public disclosure.
The MCP server configuration file should be kept secure.
See README.md § Configuration for the config file location and structure.
- Only configure library paths to directories you trust
- Avoid using paths that contain untrusted user content
- Use absolute paths when possible
- Keep library files in version control for audit trail
- Ensure library directories have appropriate permissions
- Don't run the MCP server as root/administrator
- Review generated components before committing to production libraries
For the design principles, threat model, and the concrete controls behind them, see docs/SECURITY.md.
We thank the security researchers and community members who help keep this project secure.
This security policy was last updated on 2026-09-02.