Report vulnerabilities privately to support@headerbench.com, not in a public issue. Include the extension version (from chrome://extensions), the steps to reproduce and what an attacker could do.

Reports are answered in writing. Fixes ship as a store update.

A local build trusting the development licence key is expected (see "Build from source" in the README). A store build trusting it would be a vulnerability.