Do not report security problems in a public issue. Use GitHub's private Security → Report a vulnerability feature in this repository.

nbshell runs local helper scripts and can install optional plugins from Git repositories. Only install plugins from sources you trust. Never include API keys, tokens, calendar URLs, or other credentials in issues, logs, or pull requests.