Do not post private transcripts, real token URLs or unredacted screenshots in issues. To report a vulnerability, use GitHub private vulnerability reporting when available. If it is not, open a minimal issue asking for a private contact, without exploit payloads or personal data.
Both observers are local and read-only. They are not security monitors, tamper-proof audit logs, or a defense against a compromised user account.
Version-specific details (hooks, local recovery handlers, trust boundaries):