sectionsight makes privacy claims and tests them, so a way around them counts as a security issue: data sent before consent, a token or e-mail that reaches a report, PostHog or a recording, a private page that is tracked, or a check in verify.mjs that passes when it should fail.

Please report it privately through GitHub's private vulnerability reporting, not in a public issue. You should hear back within a week.

Fixes go to the latest version on main; there are no maintained older releases.