When the environment variable AGEDEBUG=plugin is set, the wrapper types DebugReader and DebugWriter (age-core/src/io.rs:10–33, age-core/src/io.rs:38–68) duplicate every byte that flows through plugin IPC channels to the process's standard error. These streams can contain plaintext payloads, file keys, or other secrets, exposing them to log files or terminals that may be captured.

Recommendation:

Retain the debugging feature but protect it behind a compile-time #[cfg(debug_assertions)] guard. In production builds, the tee should be unreachable