Security fixes are applied to the latest release of each actively maintained plugin. Archived repositories are retained for reference and do not receive routine fixes.

Do not publish an exploitable server issue, credential leak, or permission bypass in a public issue. Open the affected repository's Security tab and use Report a vulnerability to start a private advisory.

Include the affected plugin and version, server and Java versions, required permissions, reproduction steps, impact, and any suggested mitigation. Maintainers will confirm receipt through the advisory and coordinate disclosure after a fix is available.

Ordinary bugs and compatibility problems can be reported through the affected repository's public issue tracker.