Between versions 0.6.3 and 0.11.0 of the ogham-mcp Python package, development credentials including Neon Postgres URLs and a Voyage AI API key were embedded in published source distributions. These credentials were exposed in source files such as the Makefile and test fixtures. The credentials have since been rotated by the project maintainers, and affected versions have been yanked from PyPI. Users are advised to upgrade to version 0.11.1, which removes the credentials and implements checks to prevent future leaks.