# Security Policy

## Reporting Security Issues

**Please do not report security vulnerabilities through public GitHub issues.**

If you believe you have found a security vulnerability in the Lighthouse MCP Server, please report it responsibly by following the steps below.

### How to Report

For security issues, please email [security@codingrules.ai](mailto:security@codingrules.ai) with the following information:

- **Subject**: "SECURITY: Lighthouse MCP Server - [Brief Description]"
- **Description**: A clear description of the vulnerability
- **Steps to Reproduce**: Detailed steps to reproduce the issue
- **Impact**: Description of the potential impact and attack scenarios
- **Environment**: Node.js version, operating system, and MCP client details
- **Proof of Concept**: If available, include proof-of-concept code (responsibly)

### What to Include

Please include as much of the following information as possible to help us better understand and address the security issue:

- **Type of vulnerability** (e.g., code injection, information disclosure, privilege escalation)
- **Full paths of source file(s)** related to the manifestation of the issue
- **Location of the affected source code** (tag/branch/commit or direct URL)
- **Any special configuration** required to reproduce the issue
- **Step-by-step instructions** to reproduce the issue
- **Impact assessment** including how an attacker might exploit the issue
- **Suggested mitigation** if you have ideas on how to fix it

### Response Timeline

- **Acknowledgment**: We will acknowledge receipt of your report within 48 hours
- **Initial Assessment**: We will provide an initial assessment within 5 business days
- **Status Updates**: We will keep you informed of our progress toward resolution
- **Resolution**: We aim to resolve critical issues within 30 days

### Safe Harbor

We support responsible disclosure of security vulnerabilities. If you comply with the policies below when reporting a security issue to us, we will not initiate legal action against you in response to your report:

- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of services
- Only interact with accounts you own or with explicit permission of the account holder
- Do not access, modify, or delete data belonging to others
- Contact us immediately if you inadvertently access someone else's data

## Security Considerations

### MCP Server Security

The Lighthouse MCP Server operates with the following security considerations:

- **Chrome/Chromium Usage**: The server launches Chrome/Chromium instances to perform audits
- **Network Access**: The server makes HTTP/HTTPS requests to analyze websites
- **File System Access**: Limited to Chrome's user data directory and temporary files
- **No Persistent Storage**: No user data is stored permanently by the server

### Recommended Security Practices

When deploying the Lighthouse MCP Server:

1. **Network Isolation**: Run in isolated network environments when possible
2. **URL Validation**: Validate and sanitize URLs before auditing
3. **Resource Limits**: Set appropriate resource limits for Chrome processes
4. **Access Control**: Restrict access to the MCP server to authorized clients only
5. **Regular Updates**: Keep the server and its dependencies up to date

### Known Limitations

- The server requires Chrome/Chromium, which may have its own security considerations
- Network requests are made to user-provided URLs, which should be validated
- Chrome processes may consume significant system resources

## Supported Versions

We provide security updates for the following versions:

| Version | Supported          |
| ------- | ------------------ |
| 1.x.x   | :white_check_mark: |
| < 1.0   | :x:                |

## Vulnerability Disclosure Policy

- We follow coordinated vulnerability disclosure principles
- We will work with security researchers to validate and address reported issues
- We will provide credit to researchers who report valid security issues (unless they prefer to remain anonymous)
- We will publish security advisories for confirmed vulnerabilities after fixes are available

## Contact Information

For security-related questions or concerns:

- **Email**: [security@codingrules.ai](mailto:security@codingrules.ai)
- **GitHub Issues**: Only for non-security related bugs and features
- **GitHub Security**: Use GitHub's security advisory feature for coordinated disclosure

## Dependencies

This project relies on several key dependencies that have their own security considerations:

- **Google Lighthouse**: Web auditing engine
- **Chrome Launcher**: Browser automation
- **Model Context Protocol SDK**: MCP server implementation

We regularly monitor and update these dependencies to address known security issues.

---

Thank you for helping to keep the Lighthouse MCP Server and its users safe!