Skip to main content
INFORMATIVEDRAFTDocumentation Governance
Truth Source: Repository schemas and tests are authoritative.

Security Policy

Supported Versions​

VersionSupported
1.0.x✅ Supported
< 1.0❌ Not Supported

Reporting a Vulnerability​

We take the security of the MPLP Protocol seriously. If you discover a security vulnerability, please follow these steps:

  1. Do NOT open a public issue
  2. Email the details to security@coregentis.com
  3. Include:
    • Description of the vulnerability
    • Steps to reproduce
    • Affected components (e.g., specific schema, runtime module)
    • Potential impact assessment

Response Timeline​

PhaseTimeframe
AcknowledgmentWithin 48 hours
Initial AssessmentWithin 5 business days
Status UpdatesEvery 5 business days
Resolution TargetSeverity-dependent

Severity Levels​

SeverityResponse TargetDescription
Critical24-48 hoursRemote code execution, data breach
High7 daysPrivilege escalation, authentication bypass
Medium30 daysInformation disclosure, denial of service
Low90 daysMinor issues, defense-in-depth

Scope​

This policy applies to:

ComponentRepository
Protocol Specificationsschemas/v2/
Reference Runtime@mplp/runtime-minimal
Core Libraries@mplp/core, @mplp/coordination
Integration Adapters@mplp/integration-*
TypeScript SDK@mplp/sdk-ts
Python SDKmplp (PyPI)

Out of Scope​

  • Third-party implementations not maintained by MPGC
  • Vulnerabilities in dependencies (report to upstream maintainers)
  • Issues in non-release branches

Disclosure Policy​

Once a vulnerability is resolved:

  1. We publish a Security Advisory on GitHub
  2. We credit the reporter (if desired)
  3. We update the CHANGELOG with CVE references
  4. We notify downstream maintainers

Contact: security@coregentis.com
Response SLA: 48 hours acknowledgment