Security fixes are applied to the latest release.

Please do not publish a security issue with working exploit details. Contact the maintainer privately through the repository owner's public contact channel and include:

• the affected version;
• the Zotero and operating-system versions;
• the impact;
• safe reproduction steps;
• any suggested fix.

The plug-in runs with Zotero's full desktop privileges, as all traditional Zotero plug-ins do. Install XPI files only from a source you trust.