Security fixes are provided for the latest published minor release.
Do not open a public issue for credential exposure, authorization bypass, wrong-channel writes, or supply-chain vulnerabilities. Use GitHub's private vulnerability reporting for FullStackCraft/youtube-mcp.
Include the affected version, reproduction steps using test credentials, and the expected impact. Never include live OAuth tokens, client secrets, private analytics, or production channel data.
If credentials may have been exposed:
- Revoke the affected Google Account connection.
- Delete the local profile token files.
- Rotate or delete the OAuth client in Google Cloud.
- Review YouTube Studio for unexpected metadata changes.
- Report the suspected product vulnerability privately.