secure: show Git SHA and no version in plugin constructor