Only the latest Pandalytic version published through the Chrome Web Store receives security updates.

Do not open a public issue for a security vulnerability. Use Security → Report a vulnerability in the GitHub repository to submit a private security advisory.

Include:

• Affected Pandalytic and Chrome versions
• Impact and reproduction steps
• A proof of concept, when available
• Suggested mitigation or fix

The report will be validated, an appropriate fix will be prepared, and details will remain private until the store update is available.

Security topics include:

• Code execution or HTML injection in the extension context
• Unintended transmission of notes, tags, or JSON backups
• Use of permissions outside their documented purpose
• Unsafe processing of manipulated third-party API responses
• Data collection or retention that contradicts the privacy policy