Lookout reads what coding agents write on disk and never your credentials: no OAuth tokens, no credential files, no keychain, no cookies. It sends nothing off the machine. A bug that breaks either promise is a security issue.

Report it privately through Report a vulnerability, which opens a private advisory with the maintainer. Please do not open a public issue for it. Include the Lookout version, the agent and its version, where the extension host runs (Linux, macOS, Windows, WSL, a remote) and the steps that show the problem.

The latest release is the supported version.