Please do not open public issues for security problems. Use the Security tab of this repo and click Report a vulnerability. We aim to reply within 72 hours.

In scope: anything that could trick a user into signing a transaction they did not intend, show misleading amounts or recipients, inject script through campaign content, or leak data between users.