Security
Security
Security-sensitive issues should be reported privately, not posted publicly.
Reporting a vulnerability
Do not post security vulnerabilities publicly: not in GitHub issues, not in public forums, not in social channels. Report sensitive issues by email to: [email protected]
What a useful report includes
- affected Lexora version
- browser name and version
- operating system
- reproduction steps or a concise proof of concept
- impact assessment
Security-relevant areas in Lexora
- Provider routing: unintended routing of selected text to external services
- Selected-text handling: unsafe outbound transmission or unintended exposure of selected content
- Extension message boundaries: message spoofing or boundary confusion between page context and extension context
- Token and key leakage: AI provider keys or credentials exposed or logged
- Settings and privacy bypasses: circumventing user-configured privacy controls or provider restrictions
Response
We will acknowledge security reports and coordinate disclosure timing with the reporter. Public credit is available if desired.