Unofficial project. This repository is independent from SmartMoving, LLC. Security reports for this repository should go to this project's maintainers. Vulnerabilities in SmartMoving's own platform, product, or API should be reported to SmartMoving through their official channels.

This repository is currently pre-1.0 open-source preparation. Security fixes should target main unless release branches are created later.

Please do not open a public issue for secrets, auth bypasses, or real customer data exposure.

Use a private maintainer contact or GitHub private vulnerability reporting if enabled. Include:

• What is affected
• Steps to reproduce
• Impact
• Suggested fix, if known

The MCP server requires SMARTMOVING_API_KEY, but the repo must never contain a real key.

Safe storage options:

• Agent/client private MCP config env block
• Local shell environment
• Local .env ignored by git
• Password manager or OS keychain
• Deployment secret store

Unsafe storage:

• Committed .env
• README examples with real keys
• Screenshots of config files
• CI logs printing env values
• Agent transcripts containing real API responses

1. Revoke or rotate the SmartMoving API key immediately.
2. Remove the key from git history if committed.
3. Audit access logs if available.
4. Add or tighten secret scanning.
5. Document the incident privately.

SmartMoving data can include customer names, addresses, phone numbers, email addresses, job details, payments, and internal notes. Do not use live customer payloads in docs, tests, issues, or pull requests.

Use synthetic examples only.