We take security seriously. If you discover a security vulnerability, please:

1. DO NOT open a public issue
2. DO report it via GitHub Security Advisories: Report a vulnerability
3. OR email details to the maintainer (check commit history for email)

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We're actively working on fixing these security vulnerabilities:

See our security issues for details.

Until security improvements are complete:

1. Only use on trusted networks (localhost only)
2. Don't expose the MCP port to the internet
3. Monitor vault access for unexpected changes
4. Keep backups of your vault
5. Review plugin permissions in Obsidian

{
  "httpEnabled": true,
  "httpPort": 3001,  // Change from default
  "autoDetectPortConflicts": true,
  "debugLogging": false  // Disable in production
}

• API key authentication
• Path validation framework
• Input sanitization
• Rate limiting
• Audit logging
• Encrypted sessions

Thanks to security researchers who responsibly disclose vulnerabilities.