Security

Do not test production in a way that disrupts service, accesses data you do not own, or submits secrets. Never use the audit input for private addresses, authenticated pages, session URLs, cloud metadata, or credentials.

A useful report includes the affected isWebMCP URL or integration, version, impact, minimal reproduction, and remediation idea. Remove tokens, cookies, personal data, and target-site content that is not necessary to understand the issue.

Send the report through the private disclosure channel attached to the distribution account where you obtained isWebMCP. Please allow a reasonable investigation window before public disclosure.