Only the latest release is supported. Updates are shipped as new versions; upgrade to the most recent package from Releases.

Please report security vulnerabilities privately, not through a public issue:

1. Use GitHub Private Vulnerability Reporting on this repository (Security tab → Report a vulnerability), or
2. open a GitHub issue titled "Security report" requesting a private contact channel and do not include details in the issue itself.

Please include:

• the affected version,
• reproduction steps or a proof of concept,
• the impact you believe it has.

• Acknowledgement within 7 days.
• An initial assessment and, if confirmed, a fix or mitigation plan within 30 days for issues rated medium or higher.
• Credit in the release notes unless you prefer to remain anonymous.

Fixes are released through normal tagged releases verified by CI.

• Do not include sensitive information (page contents, browsing data, credentials) in public issues or in reports beyond what is needed to reproduce.
• This extension has no remote code execution, no remote configuration, and no remotely loaded JavaScript by design. A report that requires adding any of those will be declined as out of scope.