Please report a suspected vulnerability privately to security@litetms.eu, the address in our security.txt. Do not open a public issue for it.

This covers the plugin in this repository and the LiteTMS MCP server it points to, https://mcp.litetms.eu/mcp, including its sign-in (OAuth) pages.

Helpful in a report: what you did, step by step, what you expected and what happened, and the AI app you used. While testing, do not access, change or keep data that is not your own, and do not run tests that could slow the service down for others. We answer in English or Polish.

Nothing by itself. It contains no program code, scripts or hooks: only the server address, a skill (instructions for the AI app) and images. The sign-in happens on LiteTMS pages in your browser; the plugin never sees or stores a password or an access token.