Hover Bar is a lightweight, offline plugin. Its runtime must not use telemetry, accounts, network services, sync, or files outside the vault.

Private vulnerability reporting is enabled for this repository. Use Security → Report a vulnerability to contact the maintainers privately. If that entry is unavailable, open an issue asking for a private reporting channel without including exploit details or sensitive data.

Please do not publish private notes, vault contents, credentials, or a working exploit in a public issue. A useful private report describes the affected version, the relevant editor operation, a minimal synthetic example, and the potential impact.

Content corruption, writing to the wrong document, unsafe HTML handling, dependency risks, and unexpected network or external-file access are especially relevant. Ordinary formatting bugs can use the bug-report template.

Reports should target the latest release. If you use an older version, update before checking whether the issue remains. There is no guaranteed response time.