Only the latest version (the latest release) receives fixes.

Use GitHub's private vulnerability reporting. Include:

• GiftPilot and browser versions;
• steps to reproduce and expected impact;
• a proof of concept, if you have one.

Do not open public issues or disclose details before a fix ships. First response usually within 7 days.

In scope: untrusted code execution, leaks of cookies, tokens or account data, flaws that let a page identify or control the extension.

Out of scope: SteamGifts' own detection of automation, or account suspensions caused by using the autopilot (the risk is documented in the README).