Write to rizal72 through a private security advisory on this repository. Do not open a public issue for something that is not yet fixed: a plugin runs inside the OpenCode server, with the permissions of the person running it, and a public report is a working recipe until the fix ships.

Every report gets an answer, and a fix, when one is warranted, ships as a new version on npm with the advisory naming the versions to upgrade from and to.

• Every package this repository publishes — the plugins/ directory whose package.json names it @rizal72/… — and the sources behind it: the halves, and the scripts that build and publish them. Two directories are tools for this machine alone — oc-context, which takes a built-in over, and oc-donsetch, which only keeps a binary of your own current — so neither is published or reachable by anyone else.

• OpenCode itself, and any third-party plugin listed or not listed here: report those to their own repository.
• A plugin that misbehaves because it was installed with a version OpenCode no longer supports.

Every package is published by the workflow in .github/workflows/publish.yml, through OIDC, with a provenance statement — no long-lived npm token exists to be leaked. The actions the workflow runs are pinned to immutable commits, and the dependencies are updated by Dependabot.