Only the latest release receives security fixes. Fixes are not backported to older versions, so upgrade to the newest release to get them.
Please do not open a public issue for security problems.
Report vulnerabilities privately through GitHub private vulnerability reporting.
Include:
- The
mcp-server-db2iversion - How you run it: stdio, HTTP, or Docker
- Steps to reproduce, and what an attacker could do
Redact hostnames, credentials, user profiles, and real library, table, or column names. Use stand-ins such as MYLIB.ORDERS and ibmi.example.com.
This is a small project maintained on a best-effort basis. You should get an acknowledgement within about a week. Confirmed issues are fixed in a new release and published as a GitHub security advisory, with credit to the reporter unless you prefer otherwise.