Security vulnerabilities I’ve reported through coordinated disclosure.
550+ secrets in extensions, 100+ leaked tokens enabling malicious updates to ~150K extensions.
Development API key in published extension.
Public sharing confirmation checkbox wasn't enforced.
Publicly exposed snapshots, including a disclosure affecting millions of customers.