# Security

Report security-sensitive findings privately to the repository owner after the GitHub repository is created. Do not include private images or credentials in a public issue.

The plugin accepts PNG, JPEG, WebP, GIF, AVIF, and BMP up to 1.5 MB after MIME and file-signature validation. Uploaded source bytes remain on the loopback Host workflow and are not attached to the DeepSeek model request. The native helper communicates only with the local Harness process.