NMT PuTTY is pre-release software. Do not rely on it as a credential store.

The workspace format has no password field. NMT PuTTY will not add password arguments to PuTTY command lines. Use key-based authentication, Pageant, a compatible SSH agent, saved non-secret PuTTY settings, or interactive prompts.

Workspace files can contain hosts, usernames, key paths in extra arguments, and automation scripts. Protect them accordingly and review imported files before use.

Copying a server or folder places the same profile data in NMT PuTTY's private Windows clipboard format. This can include usernames, key-file paths, extra arguments, and scripts (but never a password field). Treat clipboard contents as sensitive configuration on shared or remotely monitored systems.

workspace.json.bak and timestamped .corrupt-* recovery files contain the same configuration class as the active workspace. Recovery never creates a password field, but these files can retain usernames, key paths, arguments, and scripts after the active workspace changes. Protect or remove them using the same policy as the primary workspace.

Please report vulnerabilities privately to the repository owner. Include the affected commit, Windows and PuTTY versions, a minimal reproduction, and whether the issue can cross a process, user, or integrity boundary.