Report a vulnerability in the Sendsets MCP server, API, CLI, or anything in this repository to team@sendsets.com with "Security" in the subject. Please include steps to reproduce and do not open a public issue for it.

We acknowledge reports within three business days and keep you updated until the issue is resolved.

This repository holds manifests and agent skills only. It contains no credentials: the MCP server authenticates each user with OAuth 2.1 or their own API key, and skills never ask an agent to store or print a key.