Please do not report a suspected vulnerability in a public issue or pull request. Use GitHub's private vulnerability reporting form to report it to the maintainer privately. If GitHub indicates that private reporting is unavailable, do not disclose exploit details publicly. You may open a public issue tagging @altmn only to ask whether a confidential reporting channel can be arranged; do not include vulnerability details there. A confidential channel may not be available.

Include the affected file or version, the impact you observed, and concise reproduction steps. Use synthetic data and omit real user writing, credentials, or other private content. Please allow the maintainer time to assess a report; this project does not promise a response or fix timeline.

This repository contains plugin instructions, metadata, and packaging scripts; it does not operate a hosted service or backend. Reports about unsafe packaging, unintended disclosure, or an exploitable issue in repository-controlled code are in scope. General proofreading quality and model/host behavior are not security vulnerabilities; use the public issue tracker for non-sensitive, reproducible reports with synthetic examples.

GitHub's documentation explains repository security advisories and private vulnerability reporting.