If you find a security issue in anything Sato Hub ships — satohub.ai, the MCP endpoint, Sato OS, or these repositories — please report it privately:

• Email: security@satohub.ai
• Please include steps to reproduce and, if relevant, the affected component/version.

We aim to acknowledge reports within 48 hours. Please don't open public issues for security problems, and give us reasonable time to fix before disclosure.

• Sato OS is self-hosted: your keys never leave your machine, and there is no Sato server in the custody path. Issues affecting key handling or the local origin gate are highest priority.
• The satohub.ai MCP endpoint and export feed are read-only; data-integrity reports (a listing misrepresenting itself, a score being gamed) are welcome via the same channel or the index repo's report form.