Please report security issues privately through GitHub's private vulnerability reporting or by e-mail to browsers@rabbitone.com. Please don't open a public issue for a vulnerability.

You can expect a reply within a few days. Fixes ship in the next release of the extension, and credit is given in the release notes if you want it.

Only the latest published version of the extension is supported.

Annotator makes no network requests and stores everything locally in the browser's extension storage, so the most relevant reports are about page access (content script), the handling of imported files, and the handling of untrusted page content.