Please report suspected vulnerabilities privately via GitHub Security Advisories — do not open a public issue for security reports.

You can expect an acknowledgement within 72 hours. Please include reproduction steps and the affected package/version.

Everything in this repository: the @vitrinka npm packages and the browser extension. Reports about data the recorders capture or transmit beyond what docs/PROTOCOL.md documents are treated as security issues, not bugs.

The latest published version of each npm package and the latest Chrome Web Store extension release receive security fixes.