If you believe you've found a security vulnerability in Tempreon or this MCP server, please report it privately rather than opening a public GitHub issue.
Email: admin@tempreon.com
Please include:
- A description of the vulnerability
- Steps to reproduce
- The potential impact as you understand it
- Any relevant logs, screenshots, or proof-of-concept material
We aim to acknowledge security reports within 48 hours and provide a substantive response within 7 days.
The Tempreon MCP server runs as a hosted service. There are no client-side versions to maintain — all users automatically run the current version. Security fixes are applied to the hosted service without client action required.
In scope:
- The Tempreon hosted MCP server endpoint (
api.tempreon.com) - The marketing site and customer dashboard (
tempreon.com) - Authentication flows (OAuth 2.1 + PKCE)
- Data isolation between accounts
Out of scope:
- Issues in third-party MCP clients (Claude Desktop, ChatGPT, Cursor, etc.) — please report those to the respective vendors
- Vulnerabilities that require a user to install untrusted MCP servers or browser extensions
- Theoretical attacks without a demonstrated path to user harm
- Issues in third-party services Tempreon integrates with — see our sub-processor list and report issues to those vendors directly
Each Tempreon account is isolated at the database level via row-level security. User data is never shared with other users or used to train AI models — see the AI Use Policy for the full statement and the Privacy Policy for handling details.
For our complete security and trust posture, see:
- tempreon.com/security — security architecture and compliance posture
- tempreon.com/trust — trust center
- tempreon.com/trust/sub-processors — third-party data processors