Please report security problems privately through GitHub's "Report a vulnerability" button on the Security tab, not in a public issue. I aim to reply within a week.
- It sends your prompt (up to
maxTaskChars), optionally recent messages, and subagent task text toapi.typesafe.ai. Keys, tokens, private key blocks,password=style values and URL credentials are redacted first. Pattern redaction is not a guarantee; setsendHistoryto false for sensitive sessions. - Your TypeSafe API key is read from the plugin option, the plugin store (
/jev key) orTYPESAFE_API_KEY. The store is plain text; prefer the environment variable. - The plugin makes no other network calls and writes no files outside the Claude Code plugin store.
The latest release.