diff --git a/manifest.firefox.json b/manifest.firefox.json
index f18f9a4..960868e 100644
--- a/manifest.firefox.json
+++ b/manifest.firefox.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "2.0.9",
+  "version": "2.0.10",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "browser_specific_settings": {
     "gecko": {
diff --git a/manifest.json b/manifest.json
index 148938d..6a3f500 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "2.0.9",
+  "version": "2.0.10",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "permissions": [
     "storage",
diff --git a/package.json b/package.json
index 455ed17..617a43e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "2.0.9",
+  "version": "2.0.10",
   "private": true,
   "license": "BSL-1.1",
   "description": "Browser extension that substitutes personal data before sending to AI services",
diff --git a/src/content/content.js b/src/content/content.js
index 7d6b1fe..f8d578a 100644
--- a/src/content/content.js
+++ b/src/content/content.js
@@ -784,11 +784,25 @@
     // Record what was actually substituted so reveal knows
     for (const r of replacements) {
       if (r.replaced && r.original) {
-        // Store with lowercase key for lookup, but preserve original case
+        // Store full replacement with lowercase key for lookup
         sessionSubstitutions.set(r.replaced.toLowerCase(), {
           original: r.original,
-          replaced: r.replaced,  // preserve original case
+          replaced: r.replaced,
         });
+        // Also store individual words so reveal pairs match identity entries
+        // e.g. "Ademo Demo" → store "ademo" and "demo" separately
+        const replacedWords = r.replaced.split(/\s+/);
+        const originalWords = r.original.split(/\s+/);
+        if (replacedWords.length > 1) {
+          for (let i = 0; i < replacedWords.length; i++) {
+            if (replacedWords[i] && originalWords[i]) {
+              sessionSubstitutions.set(replacedWords[i].toLowerCase(), {
+                original: originalWords[i],
+                replaced: replacedWords[i],
+              });
+            }
+          }
+        }
       }
     }
 
diff --git a/src/lib/sync.js b/src/lib/sync.js
index d38044b..9f442a2 100644
--- a/src/lib/sync.js
+++ b/src/lib/sync.js
@@ -476,7 +476,7 @@ const SilentSendSync = {
       if (!keyInfo) return { data: null, decrypted: false, needsAuth: true };
       try {
         const decrypted = await SilentSendCrypto.decryptWithKey(data.payload, keyInfo.key);
-        return this._handleDecryptedMeta(decrypted);
+        return await this._handleDecryptedMeta(decrypted);
       } catch {
         return { data: null, decrypted: false, needsAuth: true };
       }
@@ -488,7 +488,7 @@ const SilentSendSync = {
     if (tempKeyStore) {
       try {
         const decrypted = await SilentSendCrypto.decryptWithKey(data.payload, tempKeyStore.key);
-        return this._handleDecryptedMeta(decrypted);
+        return await this._handleDecryptedMeta(decrypted);
       } catch { /* wrong key, fall through to prompt */ }
     }
 
diff --git a/src/options/options.html b/src/options/options.html
index 06ae862..f24cb12 100644
--- a/src/options/options.html
+++ b/src/options/options.html
@@ -591,7 +591,7 @@
     </section>
 
     <footer>
-      <p>Silent Send v2.0.9</p>
+      <p>Silent Send v2.0.10</p>
     </footer>
   </div>
 
diff --git a/src/popup/popup.js b/src/popup/popup.js
index 3743790..780f0be 100644
--- a/src/popup/popup.js
+++ b/src/popup/popup.js
@@ -338,11 +338,17 @@ async function showLockedUI() {
 // --- Profiles ---
 function renderProfileSelector() {
   const select = $('#profileSelect');
-  safeHTML(select, profiles.map(p =>
-    `<option value="${p.id}" ${p.id === currentProfileId ? 'selected' : ''}>` +
-    `${escapeHtml(p.name)}${p.active ? '' : ' (off)'}` +
-    `</option>`
-  ).join(''));
+  // Build options via DOM API — safeHTML + DOMParser mangles <option> elements
+  select.replaceChildren();
+  for (const p of profiles) {
+    const opt = new Option(
+      `${p.name}${p.active ? '' : ' (off)'}`,
+      p.id,
+      false,
+      p.id === currentProfileId
+    );
+    select.appendChild(opt);
+  }
 
   const profile = profiles.find(p => p.id === currentProfileId);
   $('#profileActive').checked = profile?.active ?? true;