maene is an anti-gravity authentication plugin for OpenCode: it performs OAuth 2.0 with PKCE against the Google identity provider, masquerading as the Gemini CLI client, and rotates multiple Google accounts with robin-hood quota balancing.

maene ships a single rolling release line: the latest published version always receives security fixes. Version 2.1.16 is the current release of the maintained 2.x line.

We ask researchers and users to never open a public GitHub issue for a suspected vulnerability. Instead:

1. Open a private report via the GitHub Report a vulnerability flow (Security tab > Advisories), or
2. Email the maintainer through the GitHub profile contact (https://github.com/wenathlan).

Please include a description of the issue, the affected module (auth.ts, accounts.ts, quota.ts, request.ts, ...), a minimal reproduction if possible, and the impact assessment. We will respond within 7 days and keep the reporter informed about the fix timeline.

maene stores Google OAuth refresh tokens on the local disk (antigravity-accounts.json and the version cache) with atomic chmod-0600 writes. The OAuth client id/secret pair embedded in the source (auth.ts, constants.ts) is the public install identifier of the Gemini CLI that the bypass masquerade requires - it is not an account credential and is not treated as a secret.

• The @wenathlan/maene npm package and its bundled sources.
• The .github/workflows release pipeline.
• Out of scope: Google account takeovers, Antigravity server-side behavior, and OpenCode core.