If you find a security issue, do not open a public issue with exploit details. Report it privately to the maintainer first.
Include:
- A description of the issue.
- Steps to reproduce it.
- The affected plugin and version.
- Any relevant environment details.
The maintainer can then assess the issue, prepare a fix, and coordinate public disclosure.