Plot2Panel is currently in the V0.x stage. Security fixes target the latest code on the main branch.

Use GitHub's private vulnerability reporting flow from the repository Security tab when it is available. If private reporting is unavailable, open a public issue that asks the maintainer for a private contact channel, but do not include exploit details, API keys, personal data, or other sensitive information.

Include the affected component, reproduction prerequisites, impact, and a minimal proof of concept. Redact every credential and user-supplied story.

• Store provider credentials only in .env.local or a deployment secret manager.
• Never use a NEXT_PUBLIC_ prefix for model credentials.
• Never commit .env.local, provider responses containing credentials, or screenshots of a provider console.
• Rotate a credential immediately if it appears in a commit, issue, log, screenshot, or chat message.
• Review generated patches and staged files before every push.

Plot2Panel sends story ideas to the configured text-model provider and image prompts to the configured image provider. Operators are responsible for reviewing those providers' data-handling terms before processing sensitive material.

The browser calls server Route Handlers and never receives provider keys. Server modules validate browser input and external model output. Provider-facing errors are normalized before they reach the client so secrets and upstream internals are not exposed.