vscode-grass is a purely cosmetic VS Code extension. It:

• stores data only in VS Code's globalState (local to your machine)
• makes no network requests
• runs entirely in a sandboxed webview with a strict Content Security Policy
• has no backend, no telemetry, no authentication

The attack surface is minimal, but reports are still welcome.

Always update to the latest release before reporting.

Do not open a public issue for security vulnerabilities.

Report privately via GitHub's Security Advisories or by emailing the maintainer directly.

Please include:

• Description of the issue
• Steps to reproduce
• Potential impact

You can expect an acknowledgement within 7 days.