Report suspected vulnerabilities privately, not as a public issue. Open a GitHub security advisory on the repository, or email the address in PRIVACY.md.

Please include the page or a reduced test case, the browser and version, and what you observed versus expected. A fixture under fixtures/ that reproduces it is the fastest possible report.

There is no bug bounty. This is a single-maintainer project; expect a first reply within a week.

This extension has an unusually narrow security surface — no server, no account, no network requests, no remote code — so the interesting failures are specific:

Critical. Anything that causes field contents to leave sensor.js. The product rests on one invariant: the value of a form field is read for a length check and nothing else, and is never stored, forwarded, logged, or transmitted. tools/check-invariant.js enforces the mechanical parts of this statically. A way around it is the most serious report possible.

High. A page being able to suppress detection silently. Detection that fails loudly is a bug; detection that fails while the panel still reports "nothing detected" is a security issue, because silence is what safety looks like. See the tamper handling in sensor.js and fixtures/tamper.html.

High. A false accusation against a site that is not doing anything. A confident, wrong warning damages the user's trust in every subsequent one. The matching rule in trackers.js is deliberately strict for this reason — smoke-trackers.js pins it.

Moderate. Injection through page-derived strings. Vendor names and field labels originate in page markup and are rendered in both panels. They must never be parsed as markup; the panels build DOM with createElement only, and the invariant checker forbids innerHTML there.

Moderate. Breaking a page. The extension replaces the value getters and the FormData constructor on every site, and writes inline styles onto page elements. Anything that breaks a form, a checkout, or a login is a real defect even though it leaks nothing.

• A tracker we do not detect. The vendor list is curated and finite. Missing coverage is a gap, tracked in the README, and pull requests adding a vendor to trackers.js with its real production script URL in smoke-realworld.js are welcome.
• contenteditable fields. Not instrumented at all. Documented limitation.
• A tracker on a subdomain of the site itself. Attribution compares registrable domains, so a first-party subdomain is treated as first-party. This is a deliberate trade: it prevents accusing a site of tracking itself via its own CDN, at the cost of missing CNAME-cloaked trackers, which cannot be distinguished from a legitimate CDN subdomain from inside the page.

Nothing here needs to be taken on trust:

node tools/build.js

That runs 157 checks — the privacy invariant, the verdict wording, the matching rule, the vendor list against real production URLs, and the manifest — and refuses to package if any fail. Every check has been negative-tested: each one is confirmed to fail when the thing it guards is broken.