Do not disclose a suspected security vulnerability in a public GitHub issue. Instead, report it privately through GitHub and include:
- The affected tool or URL
- A concise description of the issue and its impact
- Reproduction steps
- Any relevant browser details
Do not include real credentials, access tokens, private keys, personal data, or confidential payloads in a report. Use a minimal synthetic example.
- Treat decoded JWT claims as untrusted until your application verifies the token's signature.
- Do not use MD5 or SHA-1 for password storage or new security-sensitive designs.
- Back up encryption keys and passphrases; browser-based tools cannot recover them.
- Review generated output before using it in production.