This plugin is Zerostel packaged for Claude Code, so security reports go to the main project. Please report a vulnerability privately rather than in a public issue:
- the "Report a vulnerability" button on zerostel/zerostel's Security tab, or
- email security@zerostel.com.
That includes anything about this plugin: a file here that doesn't match the npm release it names, the hooks, or the skill. zerostel/zerostel's SECURITY.md says what to include and what happens next.