Page Capture is a browser extension that can capture visible page content. Bug reports should avoid including sensitive page screenshots, credentials, tokens, or private documents.

Use GitHub's private vulnerability reporting or security advisory flow if it is enabled for the repository. If private reporting is not available, open a GitHub issue with a minimal description and no sensitive data, then coordinate details privately with the maintainer.

Include:

• Affected version or commit.
• Browser and operating system.
• Reproduction steps using non-sensitive sample pages.
• Expected and actual behavior.
• Whether the issue affects permissions, capture privacy, exported files, or extension message handling.

Do not include:

• Real passwords, session tokens, API keys, cookies, or private URLs.
• Captures of confidential pages.
• Packaged private keys or Chrome Web Store signing material.

• The extension does not request <all_urls>.
• The debugger permission is required for native selectable-text PDF export through Chrome DevTools Protocol and should not be used outside that flow.
• Redaction is heuristic and opt-in; it should not be treated as a guarantee that every sensitive value is removed.
• Runtime message schema validation is still an improvement area and should be treated carefully when adding new message types.