Please report security issues privately — do not open a public issue or PR.

• Preferred: open a GitHub private security advisory (Security → Report a vulnerability).
• Or email support@taskade.com with details and reproduction steps.

We are a small team and do not guarantee a response time. Reports go to a monitored mailbox and are routed to engineering, and complex reports take longer to triage. We aim for 90-day coordinated disclosure when feasible, subject to investigation requirements, so please give us a reasonable window to ship a fix before going public. On request we credit you by name once a fix ships. We do not run a bug bounty program and do not pay for vulnerability reports.

The full policy is published at taskade.com/security, and it is the one that applies if it and this file ever disagree.

• Store API tokens in environment variables only — never hardcode them in source files.
• .env files are gitignored — never commit tokens to version control.
• Rotate tokens immediately if compromised.
• Generate tokens at taskade.com/settings/api.

• The published @taskade/mcp-server package runs over stdio only. It reads the token from the TASKADE_API_KEY environment variable and does not expose the token over the network.
• The HTTP/SSE mode exists only in the source dev script (yarn start:server in packages/server). It is for local development, and the npm package does not contain it.
• The dev script reads the token from the access_token URL query parameter. A proxy or server can log that URL, and the script serves plain HTTP, so a network observer can read the token. The script listens on every network interface, on port 3000 by default (set PORT to change the port). Run it only on a machine and network that you trust. If other machines can reach it, put it behind HTTPS/TLS.
• For remote use, connect to the hosted server at https://www.taskade.com/mcp. It uses OAuth 2.0, so you do not put a token in a URL. See Taskade MCP server: quick start.

This is a public repository. Never commit:

.env, .env.*            # environment files
*.key, *.pem            # private keys / certificates
*credentials*, *secret* # credential dumps
.mcpregistry_*          # MCP registry auth tokens

.env* files (except .env.example) and .mcpregistry_* are gitignored and excluded from the npm package; the key/credential patterns above are not auto-ignored, so sanity-check your staged changes before committing:

git diff --cached | grep -iE "(token|key|secret|password|credential)" | grep -v placeholder

If you accidentally commit a secret: do not push (or if already pushed, rotate the credential immediately), then remove it from history and notify a maintainer. See GitHub: removing sensitive data.

Taskade's data practices are described in the Taskade Privacy Policy. The MCP server sends requests only to the Taskade public API (https://www.taskade.com/api/v1 and https://www.taskade.com/api/v2) using the token you provide; it does not send your data to other third-party services. (In HTTP/SSE mode the token travels in the request URL, where a proxy or server can log it and a network observer can read it. Only the source dev script has that mode. The published package uses stdio.)