Security

Recommended

• Treat cross-tab messages as untrusted input
• Validate payloads before acting on them
• Do not expose secrets through plugin diagnostics

Not recommended

Using Browser Lifecycle events as an authentication mechanism.