Security

Where Plug stores data, how it protects secrets, and how to report a vulnerability.

Storage

Plug Desktop stores its data in ~/.plug as one SQLite database per user. The folder can be moved, backed up and reset from Settings → Data folder. There is no analytics or crash-reporting library in the app.

Secrets

OpenRouter keys, database passwords and the licence proof are encrypted with the operating-system secure storage (Keychain on macOS, Credential Manager on Windows, the system keyring on Linux). They are never written to the app configuration or synced to Plug Cloud.

Network

The app reaches the network only for licence activation and refresh, update checks, Plug Cloud sync when you are signed in, and the services you configure yourself: OpenRouter, GitHub or GitLab, the npm registry and weather.

Reporting a vulnerability

Email the contact address on the Contact page with the subject prefixed Security, and include a minimal, safe reproduction. Do not include real customer secrets.