Only the latest release receives security fixes. Upgrade to it before reporting.
Report privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue for a security problem.
Include the release version, the client (Codex, Claude Code, or another MCP host), and the steps or the manifest that reproduce the problem.
In scope: the MCP server, the PowerShell bridge, the PowerShell 7 installer, the skill, and the plugin manifests in this repository.
Out of scope: vulnerabilities in Microsoft Office, MathType, PowerShell, or Python themselves. Report those to their vendors.