Security fixes are applied to the latest tagged release.

Please use GitHub private vulnerability reporting. Do not open a public issue for a credential leak.

• Provider credentials are read from environment variables or an explicitly supplied local file.
• Credential files are never executed and only allowlisted variable names are loaded.
• The plugin does not ship credentials, cloud IDs, tokens, or project-specific paths.
• Research providers are read-only.
• Webmaster data is collected only through the bundled read-only OAuth/API helper; Metrika data enters through read-only aggregate imports. Mutation tools are not bundled.
• Webmaster OAuth tokens are saved outside the repository in owner-only files (0600); the helper never prints token values or sends them in URLs.
• Automatic publication, recrawl submission, Yandex Direct, login bypass, CAPTCHA bypass, and personal-level analytics are out of scope.

Generated evidence may contain public URLs and snippets. Review run artifacts before sharing them.