Do not report security vulnerabilities in public issues. Use this repository's private vulnerability reporting feature with a description, reproduction steps, impact, and any suggested mitigation.

You will receive an acknowledgement within seven days. Please allow time for a fix before public disclosure. Enable private vulnerability reporting in the repository security settings before publishing this policy.

Report issues that could expose response data, bypass extension permissions, execute untrusted code, or compromise the extension build or release process.