Security reports are welcome for the latest released version of Sheath for PhpStorm.

Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository when available, or email john@stillat.com with a description, reproduction steps, and the affected version. Reports will be acknowledged as soon as practical and coordinated privately until a fix is available.

The plugin executes the Laravel application's Artisan entry point, so it deliberately stays disabled in untrusted projects. It does not collect telemetry or transmit project source code.