Report plugin or Project Feed MCP security issues to security@projectfeed.app.

Include the affected component, the behavior you observed, and steps to reproduce it. Do not open a public issue for a vulnerability, API key, access token, or private workspace data.

The plugin repository contains no credentials. Each client signs in to Project Feed with OAuth and stores its own token. Disconnect the client in Project Feed if you believe a token was exposed.