Please do not open a public GitHub issue for security bugs.

Instead, report via GitHub Security Advisories or email robconery@gmail.com.

Include:

• A description of the vulnerability and its potential impact.
• Steps to reproduce or proof-of-concept.
• Any suggested mitigation.

I'll acknowledge within 5 business days and aim to ship a fix or mitigation within 30 days of confirmation.

This is a read-only public MCP server over an open NASA dataset. There is no authentication, no user data, and no write path. The primary security surface is SQL injection via tool arguments (all values are bound via prepared statements / column whitelists — see src/db/queries.ts).