DiscourseCopilot can read the Discourse forums you allow it to (with your login there) and stores your AI provider API keys in your browser, so security reports are taken seriously.

Please do not open a public issue for security problems. Instead, report them privately through GitHub: Report a vulnerability

Include the affected version, steps to reproduce, and the impact you expect. You should get an initial response within a week.

In scope, for example:

• Requests the extension makes to a site other than a forum you allowed or the AI provider you configured
• Leaking API keys, forum content, or chat history to another site or extension
• Prompt injection from forum content that makes the extension take actions (not just produce misleading text)

Out of scope: vulnerabilities in Discourse itself, in AI providers, or in Chrome.

Only the latest release receives security fixes. Fixes ship as a new version through the Chrome Web Store (after Google's review) and on the Releases page.