Security

docs/SECURITY.md

Security Notes

Secrets

API keys are stored in VS Code SecretStorage.
Do not commit keys to source control or workspace files.

Dependency hygiene

Run npm audit regularly.
Keep TypeScript, ESLint, and build dependencies updated.

Release hygiene

Run npm run release:local before producing VSIX artifacts.
Run npm run marketplace:preflight:strict before public publish.
Inspect VSIX contents using:

npx @vscode/vsce ls --tree

Reporting

If you identify a vulnerability, report it privately to project maintainers and avoid public disclosure until mitigated.

There aren't any published security advisories