Security

SECURITY.md

Security

webmcp-formkit parses local HTML and writes reports or updated HTML files. It does not send source files to a remote service.

Reporting Issues

Please open a GitHub security advisory or a private issue if you find:

arbitrary file writes outside the requested target
command execution through crafted HTML
unsafe handling of paths or symlinks

Do not include real secrets in public reports.

There aren't any published security advisories