Use this repository's GitHub Report a vulnerability action for suspected credential exposure, unsafe release processing, or provenance bypasses. Avoid public issues for unpatched vulnerabilities and never include tokens or account session keys in reports.

The current stable tooling release is supported. Consumers should apply released security fixes through reviewed SHA updates. Published assets remain immutable; security fixes receive new versions.

The plugin repository trusts a reviewed source repository and release workflow. A valid attestation establishes that identity; it does not prove the source is harmless. Review workflow, dependency, and allowlist changes as security-sensitive changes.