Fused Gaming MCP Security Incident Response and Disclosure Policy

Never open a public issue or discussion for security vulnerabilities.

Instead, follow the responsible disclosure process below.

If you discover a security vulnerability:

1. Email security@fused-gaming.dev with details:

   • Vulnerability title
   • Affected versions (if known)
   • Steps to reproduce
   • Potential impact
   • Proof of concept (if safe to share)
   • Suggested fix (if available)

2. Wait for acknowledgment (within 24 hours)

3. Work with us on a fix timeline

4. Coordinate disclosure before public announcement

We commit to:

• ✅ Authentication systems - User identities and sessions
• ✅ Data confidentiality - Encryption and access controls
• ✅ Data integrity - Prevention of unauthorized modification
• ✅ Availability - Protection against DoS
• ✅ Supply chain - Dependency security

We are not responsible for:

• ❌ Self-inflicted vulnerabilities (enabling experimental features, running untrusted code)
• ❌ Social engineering or phishing
• ❌ Physical security of deployment infrastructure
• ❌ User misconfiguration of firewall rules
• ❌ Zero-day vulnerabilities in third-party dependencies (until publicly disclosed)

• Secure-by-default: Safety is the default mode
• Users must opt-in to risky features
• Defaults are conservative
• No features that sacrifice security for convenience

Security patches are provided for:

• ✅ Latest major version: Full support, all fixes
• ✅ Previous major version: Critical fixes only (6 months)
• ❌ Older versions: No support

Example: If current version is 2.x:

• 2.x: Full support
• 1.x: Critical fixes for 6 months after 2.0 release
• 0.x: No support

We monitor for:

• Automated scanning (npm audit, Snyk)
• Manual code review
• Community reports
• Third-party disclosures

Upon receipt:

1. Verify the vulnerability exists
2. Determine which versions are affected
3. Assess severity (CVSS score)
4. Evaluate impact (confidentiality, integrity, availability)
5. Plan remediation approach

For each vulnerability:

1. Develop fix (patched code or workaround)
2. Test thoroughly (unit tests, integration tests, manual testing)
3. Create PR with security tag [SECURITY]
4. Fast-track review (24-hour target)
5. Tag release with version bump
6. Publish new version to npm
7. Announce in release notes and security advisory

When a security update is released:

• Update GitHub Security Advisory
• Add entry to CHANGELOG.md (Security section)
• Publish release notes
• Post to community channels
• Email security contact list (if applicable)

When using Fused Gaming MCP:

# ✅ DO: Use exact versions
npm install @fused-gaming/mcp-core@1.0.5

# ❌ DON'T: Use wildcards
npm install @fused-gaming/mcp-core@1.0.*

# ✅ DO: Regular audits
npm audit
npm outdated

# ❌ DON'T: Ignore vulnerabilities
npm install --production

# ✅ DO: Use environment variables
const apiKey = process.env.API_KEY;

# ❌ DON'T: Hardcode secrets
const apiKey = 'sk_live_...';

# ✅ DO: Update promptly
npm update
npm install @fused-gaming/mcp-core@latest

# ❌ DON'T: Stay on old versions
npm install @fused-gaming/mcp-core@1.0.0 --save

app.use((req, res, next) => {
  // Prevent clickjacking
  res.setHeader('X-Frame-Options', 'DENY');
  
  // Prevent MIME type sniffing
  res.setHeader('X-Content-Type-Options', 'nosniff');
  
  // Content Security Policy (primary XSS protection)
  res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'");
  
  // HTTPS only (if applicable)
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  
  // Disable prefetch for sensitive pages
  res.setHeader('X-DNS-Prefetch-Control', 'off');
  
  next();
});

Never commit:

• Database credentials
• API keys
• JWT secrets
• Encryption keys
• OAuth tokens

Use .env.local or CI/CD secrets:

# ✅ DO
DATABASE_URL=postgresql://...
JWT_SECRET=random-secret-key

# ❌ DON'T
DATABASE_URL=postgresql://...  # In public repo!

For security concerns with dependencies:

1. Check NPM Security Advisories
2. Report issues to package maintainers
3. Use npm audit to identify vulnerabilities
4. Update or replace compromised packages

We appreciate the security research community. Contributors who report valid vulnerabilities may receive:

• Public acknowledgment (if desired)
• Mention in security advisory
• Priority support status

Planned security improvements:

• Q2 2026: Automated security scanning in all CI/CD pipelines
• Q3 2026: Third-party penetration testing
• Q4 2026: Security certification (SOC 2 Type II)
• Q1 2027: Advanced threat detection system

For Security Vulnerabilities: Email security@fused-gaming.dev ONLY

• ❌ Do NOT open public GitHub issues for security vulnerabilities
• ❌ Do NOT use GitHub Discussions for unpatched vulnerabilities
• ✅ Do email security@fused-gaming.dev with private disclosure

For Non-Security Issues: Use GitHub Issues with appropriate labels

• Feature requests, bugs, and documentation use public GitHub Issues
• Use bug, enhancement, or documentation labels as appropriate
• Do NOT use public channels for security concerns

Fused Gaming MCP follows:

• OWASP Top 10
• SANS Top 25
• CWE/SANS Top 25
• Industry best practices

A: Follow the timeline in section 1.3 based on severity.

A: Yes, after we publish the fix and advisory (90+ days after disclosure).

A: Open a private GitHub security advisory or email again.

A: Not currently, but we acknowledge contributions.

A: No specific insurance, but we follow industry best practices.

Last Updated: 2026-05-02
Version: 1.0.0
Maintained By: Fused Gaming Security Team

For more detailed security information, see:

• ETHICAL_SECURITY_FRAMEWORK.md
• THREAT_MODEL.md
• SECURE_PATTERNS.md