Email security reports to security@superagent.sh. Do not disclose vulnerabilities in a public GitHub issue.

Include the affected file or behavior, reproduction steps, impact, and any suggested mitigation. Do not include live API keys, customer data, or other secrets.

This repository must never contain a Superagent API key. The plugin manifest declares SUPERAGENT_API_KEY, and Cursor stores the user-supplied value in plugin configuration. The MCP configuration contains only a variable placeholder.

If a key is exposed, revoke it immediately in Superagent Settings and create a replacement.

Security fixes are applied to the latest version on the default branch.