# Security policy

Do not report security issues in public issues. Email the repository owner with a minimal reproduction and avoid including API keys, account balances, or session data. The plugin must never expose a credential to browser code or logs.