# Security policy

## Reporting a vulnerability

Please do not open a public issue for a security vulnerability.

Use GitHub's **Report a vulnerability** action in the repository's **Security** tab to send a private report. Include the affected version, a concise description, reproduction steps, and any suggested mitigation.

If private vulnerability reporting is unavailable, contact the repository owner through the email address shown on the [WDahah GitHub profile](https://github.com/WDahah).

## Scope

This plugin connects to host services, model providers, project files, and persistent state supplied by the user. Review [Security and limits](docs/SECURITY-AND-LIMITS.md) before installation. Do not include credentials, tokens, private prompts, or sensitive project data in public issues.

Supported security fixes are coordinated through GitHub and released as a new version when practical.