Email i@anton.qa to report a suspected vulnerability privately. This is the maintainer's public contact address, also listed on Anton.QA. Use email rather than a public issue for sensitive reports.

Include the affected OpenCode and plugin versions, operating system, configuration scope, impact, and minimal reproduction steps. Redact credentials, private prompts, project data, and identifying paths from logs or screenshots. Do not send production secrets or exploit a shared system to demonstrate a report.

The maintainer will assess the report and coordinate any fix and disclosure. This project does not promise a response deadline or a maintained backport line. Use GitHub issues for ordinary bugs and feature requests.