Please report suspected vulnerabilities privately to support@mrscraper.com. Include the affected component, reproduction steps, and potential impact. Do not open a public issue for an unpatched vulnerability or include credentials, tokens, customer data, or private target content in a report.
The plugin repository contains no MrScraper credentials. Authentication is handled by OpenCode's OAuth 2.1 MCP connection, or by an API key that the user supplies through an environment variable. If a credential may have been exposed, revoke it through the relevant account or client immediately and then contact support.