Security fixes are made on the latest tagged release. Maintainers may also patch the immediately preceding minor release when a safe backport is practical. Git-installed development revisions are not a stable support channel.

Please do not publish an exploit, credential, private prompt, conversation export, or filesystem contents in a public issue.

Use GitHub's private vulnerability reporting for this repository when it is available. Include:

• the affected version or exact commit;
• the DeepSeek Harness and Node.js versions;
• the smallest safe reproduction;
• expected and observed behaviour;
• the security impact and whether credentials or user data were exposed; and
• any suggested mitigation.

If private reporting is unavailable, open a public issue containing only the title “Private security report requested” and non-sensitive contact information. A maintainer will establish a private channel before asking for reproduction details.

You can expect acknowledgement within seven days. We will coordinate validation, a fix, release timing, and credit with the reporter. Please allow a reasonable remediation window before public disclosure.

• Provider credentials belong to DeepSeek Harness providers and must never be stored in an agent, team, recipe, backup, run export, log, screenshot, or test fixture.
• The plugin's browser RPC channel is loopback-only. Do not expose a Web profile to untrusted networks without an authentication and reverse-proxy boundary appropriate for the host.
• Imported recipes are data, not executable code. They must be validated and previewed before any write. v0.5 accepts reviewed local JSON only; URL fetching is disabled rather than exposing an incompletely protected server-side request surface.
• Delegated members must not receive team-dispatch or unrestricted subagent-spawning tools.
• Release artifacts are checked for credentials, unexpected files, and unresolved client runtime dependencies before publication.
• Supplemental community audit tools are never allowed to inspect a developer's credential-bearing environment by default. They run only in an explicit credential-free CI/opt-in boundary with the minimum reviewed permissions; the local package/runtime gates remain authoritative.