Please do not publish security vulnerabilities in public issues.

Until a dedicated security contact is established, open a private security advisory in the GitHub repository if that feature is available. Include the affected version, reproduction steps, impact, and a suggested mitigation if known.

Plugin code and imported project files should be treated as potentially untrusted input. Security fixes should preserve sandboxing, permission checks, and parser isolation.