Please report suspected vulnerabilities privately to support@mrscraper.com. Include the affected component, reproduction steps, and potential impact. Do not open a public issue for an unpatched vulnerability or include credentials, tokens, customer data, or private target content in a report.

The plugin repository contains no MrScraper credentials. Authentication is handled by Antigravity's OAuth 2.1 MCP connection. If you use the API key fallback, the key stays in your own Antigravity configuration and carries full account authority. If a credential may have been exposed, revoke it through the relevant account or client immediately and then contact support.