Report a security concern.

Contact

Email hello@winevery.com with the subject “Winevery security report”. Include the affected Winevery URL, concise reproduction steps, impact and a safe proof of concept. Never send live passwords, payment details or copies of another person’s data.

Testing scope

Reports can cover www.winevery.com and its public MCP endpoint at /api/mcp. Test only your own account or a reviewer account supplied privately for the submission. Stop when you have enough evidence to describe an issue. Do not access another user’s records, bypass request limits, run denial-of-service tests or modify data you do not own.

What the connector exposes

The four MCP tools access public catalogue data only. They do not use website cookies or bearer tokens to retrieve member information. Input schemas, origin checks, body-size limits and per-process throttling bound requests. We do not claim a third-party security certification or a guaranteed response time.

The connector privacy notice explains its data handling. For general product or account help, use support.