Please report security issues privately to hi@fauzul.com, not as public issues. Include the version (shown on the extensions page), what you did and what happened.

ScrollCollector keeps the collection on your device and sends post text off it only if you turn on a cloud provider. Reports about that boundary, the API key storage or the content scripts are the most useful.