Please do not report security vulnerabilities in a public issue. Use GitHub's private vulnerability reporting for this repository and include the affected plugin, version, tag, reproduction steps, and impact.

Release artifacts are expected to be verified with an independent digest, the curated registry, or a build attestation. A same-origin release checksum is trust-on-first-use evidence only.