Please don't open a public issue for security problems.

Report them privately through GitHub: go to the Security tab of this repository and choose Report a vulnerability. Only the maintainers can see the report.

Please include what you found, how to reproduce it, and what impact you think it has. We'll acknowledge your report, keep you updated while we work on a fix, and credit you when it's published if you'd like.

This repository covers the open-source SQID runtime, SDK, MCP server and tools. Issues with the hosted SQID Cloud service (app.sqid.dev and its APIs) can be reported the same way.