Only the newest release gets fixes: the version live in the Firefox, Edge and Opera stores, and the newest tag on Releases. Security fixes ship as a same-day patch release.

• The extension runs only code from its own package. Its content security policy is script-src 'self', and it loads nothing from the web to run.
• It talks only to the test server: the default Cloudflare Worker, or a server you add in settings. Remote servers must use https; plain http is allowed only for localhost, 127.0.0.1 and .local names, and each custom server needs a permission you grant.
• The test server reads nothing it is sent: uploads are discarded, and downloads are generated bytes. It keeps no logs and stores no results.
• Share links carry the result in the URL fragment, which browsers never send to a server.

A report is in scope if it breaks one of these, for example code running from outside the package, data reaching a server it shouldn't, or the worker or the self-host server storing or leaking anything.

Please don't open a public issue. Use Report a vulnerability under the Security tab, or email hello@ajithakdev.com with what you found and how to reproduce it. You'll get a reply within a few days, and a fix or a plan before anything is made public.