Security

Reporting a vulnerability

Please do not open a public issue. Report it privately through GitHub instead: go to the Security tab of this repository and choose Report a vulnerability.

Include what an attacker can do, the steps to reproduce it and the Monocle, Laravel and PHP versions you used. You will get a reply within 7 days, and you will be kept informed until the issue is fixed and disclosed.

Supported versions

Only the latest release receives security fixes.

Scope

Monocle is a development tool and records nothing in production unless it is turned on. Reports are still welcome when Monocle exposes data it should not, for instance a secret that is not masked, a dashboard or MCP server reachable where it should not be, or captured data written outside the configured storage.