If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public issue
2. Email: fullback.94@gmail.com
3. Include: description, reproduction steps, and impact assessment
4. You will receive a response within 48 hours

• Never commit .p8 private keys to version control
• Use environment variables or a companies.json file outside your repo
• Add companies.json, *.p8, *.pem, *.key to your .gitignore
• Rotate App Store Connect API keys periodically
• Use --workers flag to limit exposed tools to only what you need
• JWT tokens are held in memory only and expire after 20 minutes
• Prefer read-only MCP smoke checks (auth_generate_token, auth_token_status, apps_list limit=1) after reloads
• Review tool annotations before approving high-risk actions such as submit, release, delete, revoke, clear, or cancel