ContentLens has not published a production release. No version currently receives security support.

This table will be updated before the first release:

Use GitHub private vulnerability reporting for this repository:

https://github.com/everton-dgn/content-lens/security/advisories/new

If that channel is unavailable, contact the repository owner through the GitHub profile and request a private channel without disclosing vulnerability details publicly.

Do not open a public issue for:

• Credential exposure.
• Extension privilege escalation.
• Cross-context message forgery.
• Remote profile corruption or unauthorized access.
• Prompt injection that reaches privileged actions.
• Model or dependency supply-chain compromise.
• Privacy leaks involving browsing or preference data.

• Affected document, component or proposed version.
• Reproduction steps or proof of concept.
• Expected and observed impact.
• Required permissions and attacker position.
• Suggested mitigation, if known.
• Whether details have been shared elsewhere.

Do not include real credentials, personal browsing data or third-party private information.

These are project targets, not a guarantee:

Complex issues may require more time. The reporter receives a status update when a target cannot be met.

The maintainer coordinates disclosure after a fix or documented mitigation exists. Credit is offered unless the reporter requests anonymity.

Good-faith research that avoids privacy violations, service disruption, data destruction and unauthorized persistence will be treated as helpful security work. This statement does not authorize testing against third-party platforms or accounts.

Project trust boundaries and required controls are documented in:

• Threat model
• Privacy and security
• Supply-chain policy
• Credential handling open decision
• Reviewable AI assistance
• Truthful idempotent operations