Please report a vulnerability privately through GitHub's advisory form or to [email protected] (subject "Security: lenz-gdocs"), not in a public issue. Include what you found, how to reproduce it and what it affects. We reply within three working days.

In scope: this add-on's code, the way it stores your Lenz sign-in (OAuth tokens, or a pasted API key in the internal build: Apps Script user properties, never document properties and never sent to the sidebar), and anything that lets a Doc's content or Lenz's response run as code in the sidebar or change the Doc without the user's click.

Lenz's own API and website are covered by the same address.