We take security seriously. If you discover a security vulnerability, please follow these steps:

Security vulnerabilities should not be disclosed publicly until they have been addressed.

Send details to: security@paean.ai

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution: Depends on severity and complexity

• Never commit .env files or config files containing tokens
• Store authentication in ~/.openpaean/config.json (auto-excluded from git)
• Use environment variables for CI/CD: OPENPAEAN_API_URL

Only configure MCP servers from trusted sources. The CLI executes commands defined in your MCP config file.

// ~/.openpaean/mcp_config.json
{
  "mcpServers": {
    "trusted-server": {
      "command": "npx",
      "args": ["-y", "trusted-package@latest"]
    }
  }
}

• All API communication uses HTTPS by default
• JWT tokens are stored locally and transmitted via Authorization headers
• Tokens can be revoked server-side at any time

We appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities.