If you find a security vulnerability in the Redocly plugin or in the Redocly MCP server at https://redocly.com/mcp, send an email to security@redocly.com. Do not open a public issue.

Include these items:

• What the vulnerability is and what an attacker can do with it.
• The steps that reproduce it.
• The AI client, its version, and the plugin version.

Only the latest version of the plugin receives fixes.