Citedy Plugin 1.0.x receives security updates while it remains the current public major version.

Report suspected vulnerabilities privately to hello@citedy.com. Include the affected version, reproduction steps, impact, and any relevant request ID. Do not include customer data, OAuth tokens, cookies, API keys, or other credentials.

Do not open a public issue before Citedy has assessed the report.

• Authentication is delegated to the client's OAuth flow and Citedy's authorization server.
• The package contains no credentials and no literal authorization headers.
• MCP tool availability does not grant access by itself; Citedy enforces authenticated workspace and tenant boundaries server-side.
• Article publication and settings changes remain user-controlled actions.
• Competitor URLs, source text, generated content, and MCP responses are untrusted data rather than agent instructions.
• The package does not execute local binaries, install dependencies, or use plugin hooks.