feat: release authentication laboratories 0.3.0

src/components/HelpDialog.tsx

@@ -46,6 +46,12 @@ export function HelpDialog({
           hash/digit profile. The timeline and drift finder are diagnostics;
           HOTP counters must remain synchronized.
         </p>
+        <p>
+          Migration QR codes and plaintext exports reveal OTP seeds. Aegis and
+          PSKC password decryption happens locally. Collection snapshots omit
+          seeds but include stable fingerprints that can correlate accounts.
+          Camera scanning starts only after your click and stops automatically.
+        </p>
         <h3>Passkey inspection</h3>
         <p>
           Inspection is offline. Verification is layered: client-data
@@ -61,6 +67,11 @@ export function HelpDialog({
           Toolbox origin remains inspect-only so unrelated apps do not share its
           credential namespace.
         </p>
+        <p>
+          Extension results are browser/authenticator capabilities, not security
+          guarantees. Redacted ceremony traces retain signed evidence for replay
+          and may therefore still contain correlatable identifiers.
+        </p>
         <p>
           No authentication material, file, telemetry or request leaves this
           tab.