SECURITY.md

# Security

## Reporting a vulnerability

Please report a suspected vulnerability privately to
[security@litetms.eu](mailto:security@litetms.eu), the address in our
[security.txt](https://litetms.eu/.well-known/security.txt). Do not open a public issue for it.

This covers the plugin in this repository and the LiteTMS MCP server it points to,
`https://mcp.litetms.eu/mcp`, including its sign-in (OAuth) pages.

Helpful in a report: what you did, step by step, what you expected and what happened, and the AI app
you used. While testing, do not access, change or keep data that is not your own, and do not run
tests that could slow the service down for others. We answer in English or Polish.

## What this plugin can do on your computer

Nothing by itself. It contains no program code, scripts or hooks: only the server address, a skill
(instructions for the AI app) and images. The sign-in happens on LiteTMS pages in your browser; the
plugin never sees or stores a password or an access token.