Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue for a security report.

This is a Pi extension and Pi extensions execute with full system access. Reports involving unsafe extension behavior, configuration handling, subagent execution, or sensitive-data exposure are in scope. Include a minimal reproduction and impact description where possible; do not include secrets or private data.