This plugin follows security best practices by requiring users to provide their own Google Gemini API keys:

• No hardcoded secrets in plugin code
• User API keys never logged or exposed
• Keys stored locally in TypingMind settings
• Encrypted transmission via HTTPS to Google's API

To get your API key:

1. Visit Google AI Studio
2. Create or select a project
3. Generate an API key
4. Enter in plugin settings (required field)

Best Practices:

• Never share your API key publicly
• Rotate keys periodically (quarterly recommended)
• Monitor usage in Google Cloud Console
• Use rate limits to prevent abuse
• Revoke compromised keys immediately

Do NOT create public GitHub issues for security vulnerabilities.

Email: ja@satware.com (Jane Alesi, Lead AI Architect)

• Initial Response: Within 48 hours
• Assessment: 3-5 business days
• Fix Timeline: Severity-dependent
  • Critical: 1-3 days
  • High: 1-2 weeks
  • Medium: 2-4 weeks
  • Low: Next release cycle

We follow responsible disclosure:

1. Researcher reports vulnerability privately
2. We acknowledge and investigate
3. We develop and test fix
4. We notify affected users
5. We publicly disclose after fix deployment (30-90 days)

Currently, we do not offer a formal bug bounty program. Security researchers who report valid vulnerabilities will receive public acknowledgment in release notes.

1. API Key Security:

   • Use dedicated API keys for this plugin
   • Enable billing alerts in Google Cloud Console
   • Monitor usage regularly
   • Rotate keys every 90 days

2. Safety Settings:

   • Default setting: balanced (recommended)
   • Use strict for sensitive environments
   • Only disable safety filters if absolutely necessary

3. Rate Limiting:

   • Google enforces: 300 requests/minute (paid), 1,500/day (free)
   • Implement application-level limits if needed
   • Monitor API quotas in Google Cloud Console

What data is sent to Google:

• Text prompts for image generation/editing
• Uploaded images (in edit mode)
• Generation parameters (temperature, topP, topK)

What is NOT sent:

• Your API key is sent only in request headers (encrypted via HTTPS)
• No conversation history
• No user personal data
• No plugin configuration settings

Google's Data Usage:

• Review Google AI Studio Terms
• Gemini API may use inputs for service improvement (opt-out available)
• Images generated include SynthID watermarking

• User data controller: User (API key owner)
• Data processor: Google (Gemini API)
• Plugin role: Data intermediary (stateless)
• Data retention: No data stored by plugin

• Encryption: TLS 1.3 for all API communications
• Authentication: API key-based (user-controlled)
• Authorization: Google-managed
• Audit logging: Available in Google Cloud Console

• ✅ Required user-provided API keys
• ✅ Modern attachment access patterns
• ✅ Comprehensive error handling
• ✅ Enhanced input validation

Last Updated: November 10, 2025
Maintained By: satware AG
License: MIT