Saccade is pre-release software. Only the latest commit on main is currently in scope for security fixes; there are no supported stable versions yet.

Please use GitHub's Report a vulnerability / private security advisory flow for this repository. Do not open a public issue for a suspected vulnerability, credential exposure, sandbox escape, protected-value leak, or signing-key problem.

Include the affected commit and platform, a minimal reproduction, the expected security boundary, and the observed result. Remove cookies, tokens, passwords, one-time codes, personal form values, profile data, and crash dumps containing private browsing state.

Security reports are especially useful when they demonstrate one of these failures:

• an ungranted origin exposes an observation or accepts input;
• a password, OTP, CVV, token, cookie, or protected identifier reaches agent output, replay, logs, or artifacts;
• input is accepted for a stale revision, different tab, or browser instance;
• a failed or unverified native action is reported as successful;
• a package installs a native host for an unapproved extension identity; or
• an official artifact has an invalid signature, manifest, or checksum.

Saccade does not promise compatibility with every site and does not bypass CAPTCHA, bot verification, DRM, or proprietary codec restrictions. A site compatibility failure without a security-boundary violation can be reported as a normal issue after the repository opens public issue tracking.