We actively support the following versions of the Dynatrace Managed MCP Server:

We take security seriously. If you discover a security vulnerability, please report it responsibly:

1. Email: Send details to security@dynatrace.com
2. Include:
   • Detailed description of the vulnerability
   • Steps to reproduce the issue
   • Potential impact assessment
   • Suggested mitigation if known

• Environment: Dynatrace Managed version, MCP Server version
• Scope: Which components are affected
• Attack Vector: How the vulnerability could be exploited
• Impact: What data or systems could be compromised
• Proof of Concept: Minimal reproduction example (if safe)

• Acknowledgment: Within 24 hours
• Initial Assessment: Within 3 business days
• Regular Updates: Every 5 business days
• Resolution Target: 30 days for high/critical, 90 days for lower severity

# Use environment variables, never hardcode tokens
export DYNATRACE_API_TOKEN="your-secure-token"
export DYNATRACE_MANAGED_URL="https://your-managed-instance.com"
export DYNATRACE_ENVIRONMENT_ID="your-env-id"

• Use HTTPS connections only
• Implement proper firewall rules
• Restrict network access to authorized systems
• Use VPN for remote access

• Rotate API tokens regularly (every 90 days recommended)
• Use least-privilege access principles
• Monitor API usage and access patterns
• Implement proper logging and auditing

# Use secrets management in production
kubectl create secret generic dynatrace-config \
  --from-literal=api-token="$DYNATRACE_API_TOKEN" \
  --from-literal=environment-id="$DYNATRACE_ENVIRONMENT_ID"

# Run with non-root user
docker run --user 1001:1001 dynatrace-managed-mcp

• Validate all inputs with Zod schemas
• Use TypeScript for type safety
• Implement proper error handling
• Never log sensitive data
• Use secure dependencies only

# Check for vulnerabilities
npm audit
npm audit fix

# Lint for security issues  
npm run lint:security

# Run security tests
npm run test:security

• Keep dependencies up to date
• Use npm audit to check for vulnerabilities
• Pin dependency versions in production
• Use only trusted packages with good maintenance

• Risk: API tokens provide broad access to Dynatrace data
• Mitigation:
  • Use tokens with minimal required permissions
  • Implement token rotation policies
  • Monitor token usage patterns
  • Use short-lived tokens when possible

• Risk: MCP server may be exposed to networks
• Mitigation:
  • Use proper network segmentation
  • Implement authentication/authorization
  • Monitor network traffic
  • Use secure transport protocols

• Risk: Observability data may contain sensitive information
• Mitigation:
  • Implement data classification
  • Use data masking when appropriate
  • Control access based on data sensitivity
  • Implement audit logging

• Risk: AI models may process sensitive operational data
• Mitigation:
  • Implement data sanitization
  • Use privacy-preserving techniques
  • Control data retention policies
  • Monitor AI model access patterns

• GDPR: Ensure personal data handling compliance
• SOC 2: Implement security controls framework
• ISO 27001: Follow information security standards
• PCI DSS: Handle payment data securely if applicable

• Implement role-based access control (RBAC)
• Use multi-factor authentication (MFA)
• Maintain access audit logs
• Regular access reviews and certifications

1. Immediate Actions:

   • Disconnect affected systems if safe to do so
   • Preserve evidence for investigation
   • Document the incident timeline
   • Notify stakeholders as required

2. Contact Information:

   • Security Team: security@dynatrace.com
   • Emergency: Include "SECURITY INCIDENT" in subject line

3. Investigation Support:

   • Provide detailed logs and system state
   • Assist with impact assessment
   • Implement recommended mitigations
   • Participate in post-incident review

• Security patches are released as soon as possible
• Critical vulnerabilities may trigger emergency releases
• Subscribe to security notifications via GitHub
• Monitor the CHANGELOG.md for security-related updates

For security-related questions that are not vulnerabilities:

• GitHub Discussions (for general security best practices)
• Email security@dynatrace.com (for specific security concerns)

Remember: When in doubt, report it. We appreciate responsible disclosure and will work with you to address legitimate security concerns promptly and professionally.