This is a small browser-side plugin with no runtime dependencies and no privileged host behavior (the host half only announces the plugin to the agent). Still, if you find a bug that could be a security issue, please open a private advisory via GitHub (Security → New advisory) or open an issue.

The plugin runs entirely in the user's browser; do not paste or publish sensitive session data in issues.