# Security

storebound handles store credentials (a Google Play service account key and an App Store Connect API key) and can
change live store listings, so security reports matter to me.

## Reporting

Please do not put details in a public issue. Open an issue titled "security contact" without details, and I will get
in touch to receive the report privately. I aim to answer within a week and to ship a fix before anything is
published.

## How storebound treats credentials

- Credentials come only from environment variables or `.storebound/credentials.json` in your project; `init` adds
  `.storebound/` to `.gitignore`. storebound does not print them or copy them anywhere.
- The CLI talks to the official store endpoints (`androidpublisher.googleapis.com` and `www.googleapis.com` uploads,
  `oauth2.googleapis.com`, `playdeveloperreporting.googleapis.com` for vitals, `storage.googleapis.com` for your own
  Play reports bucket, `api.appstoreconnect.apple.com` and the upload / analytics download URLs it hands out), Google
  Fonts for `shots fonts`, your own game URL for capture / record, and your own website when `validate` checks the
  privacy policy URL and `app-ads.txt`.
- The MCP server exposes no tool that submits for review (App Review or Beta App Review), releases, resumes or
  completes a rollout, cancels a submission, deletes anything, invites or removes testers, sends review replies,
  applies prices or starts / stops a store experiment; every write tool is a dry run unless `dry_run: false` is passed.
- Personal data the CLI handles (tester emails, reviewer names in reply drafts, crash reports, analytics) stays in
  the gitignored `.storebound/`; tester emails are masked in its output.
- `bun run ci` scrubs the repository for keys, issuer ids, emails and private names before every release.

## Supported versions

Only the latest release gets fixes.