This project is pre-1.0. Only the latest released version is supported — there are no backported fixes to earlier tags. If you are pinned to an older ref, the fix for anything reported here will arrive as a new release, not as a patch to the version you pinned.

Please do not open a public issue for a security problem. A public issue tells everyone at the same moment, including anyone who would use it.

Use GitHub's private vulnerability reporting instead: the Security tab of durchnull/claude-plugins → Report a vulnerability. That channel is private between you and the maintainer, and it exists so you can share details without publishing them.

Please include what you did, what happened, and what you expected instead. A minimal reproduction is worth more than a long description. You will get an acknowledgement within a few days; if a report is valid, you will be told when a fix ships and credited in the release notes unless you ask not to be.

This repository is a catalog: JSON metadata pointing at plugin repositories. It ships no runtime code, so its security surface is entirely about where entries point. In scope: an entry that resolves to a repository other than the one it names, a pinned ref or SHA that does not match the tag it claims, and any entry that would install something a reader of the catalog would not expect. A vulnerability in a plugin itself belongs in that plugin's own repository, not here.

Not every defect is a security problem, and treating them alike wastes the private channel:

• A crash, a wrong result, or a confusing report with no security consequence — open a normal issue.
• Behaviour that requires the user to have already granted a permission the tool asks for plainly.
• Anything that needs an attacker to already control the machine or the repository.

There is no bug bounty. This is a personal open-source project, and the thanks are sincere but non-monetary.