This plugin handles OAuth access and refresh tokens for an Anthropic Claude Pro/Max account. Tokens are stored only in the macOS Keychain (service com.guttmann.typewhisper-claude.oauth) and are never transmitted anywhere except to Anthropic's official OAuth and Messages endpoints. The plugin makes no telemetry calls.

Please report security issues privately — do not open a public issue, and do not include real tokens, authorization codes, or account identifiers in any report.

• Preferred: open a GitHub private security advisory via the repository's Security → Report a vulnerability tab.
• Include: affected version, a description of the issue, and reproduction steps.

Anything that could expose stored tokens, leak them off-device, or weaken the PKCE/OAuth flow is in scope. Please allow a reasonable window for a fix before any public disclosure.

Revoke access from your Anthropic account (Claude account settings → connected apps / API access), then remove the stored credentials from the macOS Keychain (Keychain Access → search com.guttmann.typewhisper-claude.oauth → delete). Re-authenticating from the plugin issues a fresh token pair.

This is not an official Anthropic or TypeWhisper project. As documented in the README, it authenticates against the Anthropic API using the same OAuth client ID that Claude Code uses, which sits in a gray area of Anthropic's Terms of Service. This security policy covers the handling of credentials by this software; it does not constitute permission to use the plugin in violation of any applicable terms.