Use when auditing Claude Code plugin security or implementing secure practices - security guidelines with credential handling, hook safety, and MCP security for November 2025 specifications