Please do not open a public issue.

Use GitHub's private vulnerability reporting: go to the Security tab of this repository and choose Report a vulnerability. It is private to the maintainers and requires no email exchange.

Include what you found, how to reproduce it, and what an attacker gets. A proof of concept helps; a working exploit is not required, and please do not test against anyone else's browser or any third party's site.

What to expect. An acknowledgement within 5 working days, an assessment within 10, and a fix or a written explanation of why not. We will credit you in the release notes unless you would rather we did not. This is a small project without a bounty programme; we can offer attention and credit, not money.

Coordinated disclosure. Please give us 90 days before publishing, or less if the issue is being exploited. If we go quiet for 14 days, treat that as consent to publish — a project that stops answering has forfeited the right to ask you to wait.

The primary security boundary is that everything this extension reads is attacker-controlled. Findings against that boundary are the most valuable ones.

• Prompt injection that changes an output verdict, leaks a system prompt, or causes a fetch to a page-supplied URL. Our canary suite covers the classes we thought of; new classes are exactly what we want. See docs/THREAT-MODEL.md §T2.
• Fabrication. Any path that produces a source, quote, or citation not present in a document fetched during that request. Quote verification is a runtime assertion; a way around it is a serious bug.
• Capability escalation from page content — page text causing a tool call, a configuration change, or a network request to an address the page chose.
• Key exposure. Any path where a provider key becomes reachable from a content script, a page, or disk.
• Silent exfiltration. Any network call not triggered by a user action, or to an endpoint the options page did not enumerate.
• Permission and CSP weaknesses in the extension manifest.
• Anchor confusion — a highlight or a quote that points at text other than the text it was computed from. This one is quiet and dangerous: a finding attached to the wrong sentence is worse than no finding.
• Supply chain, including our build producing something the source does not describe.

• The tool being wrong. A misclassified stance, a missed claim, an over-eager detector: those are bugs, and LIMITATIONS.md documents the ones we know about. Open a normal issue.
• Attacks requiring a browser that is already compromised, or physical access.
• Denial of service against a third-party provider by configuring the extension to hammer it.
• Vulnerabilities in a provider's own service. Report those to the provider.
• The optional self-hosted proxy deployed with the shipped hardening removed. Please do still tell us if the shipped configuration is unsafe.
• Findings from an automated scanner with no demonstrated impact.

Test against real people. This project exists because tools in this genre get pointed at individuals; do not point this one at someone to demonstrate a bug. Use your own pages, your own images, and the fixtures in this repository.

Face identification and author identification are absent by design and permanently. Their absence is not a gap to be reported. See CONTRIBUTING.md.