For information about the extensions security model, in particular what is and is not considered a security vulnerability, refer to the extensions security FAQ.