Do not disclose security vulnerabilities in a public issue.

Use GitHub's private vulnerability reporting to report a potential vulnerability involving the registry definition, connection guidance, authentication flow, or remote codev MCP service.

Include the affected tenant or endpoint only when necessary, redact credentials and customer data, and never attach application tokens, OAuth tokens, Salesforce credentials, or other secrets.

• Interactive users should connect through codev's OAuth 2.1 flow rather than copying credentials into MCP configuration files.
• Automation should keep application tokens in a secret manager and provide them through a protected runtime environment.
• Treat application tokens as privileged credentials: unlike an interactive connection, they are not scoped to one person's identity.