diff --git a/Cargo.toml b/Cargo.toml
index 96c2136..212a1f1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -109,8 +109,8 @@ strip = true
 opt-level = 3
 debug = false
 
-# Security fix for RUSTSEC-2026-0002: IterMut violates Stacked Borrows  
 # Patch vulnerable lru 0.12.5 by replacing iced_glyphon with patched version
 # The patched version updates lru from 0.12.1 to 0.16.3 which includes the security fix
+# See SECURITY-FIX-RUSTSEC-2026-0002.md for details
 [patch.crates-io]
 iced_glyphon = { path = "vendor/iced_glyphon" }
\ No newline at end of file
diff --git a/crates/rustirc-plugins/src/api.rs b/crates/rustirc-plugins/src/api.rs
index 18260f9..52ec9f3 100644
--- a/crates/rustirc-plugins/src/api.rs
+++ b/crates/rustirc-plugins/src/api.rs
@@ -50,7 +50,7 @@ use std::error::Error;
 pub type PluginResult<T> = Result<T, Box<dyn Error + Send + Sync>>;
 
 /// Plugin capability flags
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub struct PluginCapabilities {
     /// Can handle IRC messages and events
     pub handles_events: bool,
@@ -64,18 +64,6 @@ pub struct PluginCapabilities {
     pub network_access: bool,
 }
 
-impl Default for PluginCapabilities {
-    fn default() -> Self {
-        Self {
-            handles_events: false,
-            provides_commands: false,
-            provides_gui: false,
-            uses_storage: false,
-            network_access: false,
-        }
-    }
-}
-
 /// Plugin metadata and information
 #[derive(Debug, Clone)]
 pub struct PluginInfo {
diff --git a/crates/rustirc-scripting/src/api.rs b/crates/rustirc-scripting/src/api.rs
index 231ec72..9833634 100644
--- a/crates/rustirc-scripting/src/api.rs
+++ b/crates/rustirc-scripting/src/api.rs
@@ -28,7 +28,6 @@
 //! - Integrate with external services
 
 use rustirc_core::events::{Event, EventBus};
-use rustirc_protocol::{Command, Message};
 use std::sync::Arc;
 
 /// Main scripting API interface
@@ -52,8 +51,12 @@ use std::sync::Arc;
 /// ```
 pub struct ScriptApi {
     /// Event bus for receiving and sending events
+    /// Reserved for future Phase 4+ features
+    #[allow(dead_code)]
     event_bus: Option<Arc<EventBus>>,
     /// Connection ID for script context
+    /// Reserved for future Phase 4+ features
+    #[allow(dead_code)]
     connection_id: Option<String>,
 }