Please report security issues privately to the project owner through the contact options on the developer profile. Do not open a public issue containing credentials, Instagram cookies, exported data, usernames, or personal scan results.

Supported security fixes target the latest release. Reports should include a minimal sanitized reproduction, impact, browser version, and app version.

The project intentionally does not accept pasted cookies and does not request the Chrome cookies permission. Any change that exports authentication material, adds remote analytics, weakens the explicit origin allowlist, or executes remote code should be treated as a security regression.