Report security-sensitive issues privately by using GitHub's private vulnerability reporting for this repository when available. If private reporting is not available, open a minimal GitHub Issue that asks for a private contact path without publishing exploit details.

Do not include credentials, cookies, license keys, private media URLs, or other secrets in public issues.

The previously committed Chrome extension signing key must be treated as exposed. Future store builds must use a fresh signing identity.