Autofill vulnerability

Hey jmjm ,
The URLs are legitimate most of the time, it doesn't matter though - 1Password will not autofill or suggest autofilling if the domain of the website is different than the domain that is documented in the login entry in 1Password.

So for instance, if you have a login entry with "https://apple.com" in it, you will be able to open and fill it on Apple's website (and every subdomain they own, such as itunes.apple.com, support.apple.com etc), but you won't be able to autofill it on a different domain such as apple.somewebsite.com or appllee.com or amazon.com.