Resources
Start with Balanced, test a troublesome site, then make a narrow exception.
Find the site permission that delivers the alert, then revoke it.
Treat a leaked saved credential as unsafe, then verify the account separately.
Choose sync categories before you expose passwords, tabs or payment details.
Close every InPrivate window and check what remains on the device.
Both reduce browser exploit exposure; coverage and compatibility differ.
The same scary wording may come from two different browser mechanisms.
A password match usually originates outside the browser.
Stopping future transfer does not undo data already copied.
The window changes local retention, not who can observe a connection.
Choose the person, permission and waiting period deliberately.
Understand Lock, Log out and what remains on the device.
Narrow URI matching for the particular credential, then test it.
Decide whether convenience and vault concentration fit the account.
Treat the warning as a credential problem, not proof of account takeover.
Both are powerful; only one changes control of the vault.
The two timeout actions leave different recovery requirements.
A wider match is convenient but may offer a credential in more places.
Both add a sign-in step, but they do not share the same failure boundary.
A leaked password string is evidence of risk, not an activity log for your account.