Do not report suspected vulnerabilities in a public issue. Use the repository's
private GitHub security advisory flow or email [email protected].
Never commit OAuth tokens, reviewer credentials, provider keys, Space secrets, or a generated OpenAI domain-verification token. The plugin uses the official remote OAuth endpoint and does not accept embedded bearer-token configuration.