1.2 KiB
Security
StreamXR runs on YouTube pages while you're signed in, and it makes requests to YouTube as
you (for Subscribe, Like and your feeds). The optional Skip Helper uses Chrome's debugger
permission. So security problems matter here, even in a small project.
Reporting a vulnerability
Please don't open a public issue. Use GitHub's private reporting instead: the repository's Security tab -> Report a vulnerability. Include what an attacker could do, the steps to reproduce, and the StreamXR (and Skip Helper) version.
You'll get a reply as soon as the maintainer can; this is a one-person hobby project, so please allow some time. Once a fix is released, the report can be made public, with credit if you'd like.
What counts
For example:
- A web page or another extension getting StreamXR to make requests to YouTube as the user, or reading the user's YouTube data through it.
- Anything that makes the Skip Helper act outside its one job (pressing YouTube's visible Skip ad button in the tab that asked) or on a tab that isn't youtube.com.
- StreamXR or the Skip Helper needing, or quietly using, more permissions than the manifests list.
Bugs that only affect how videos look or play are ordinary issues: use the forms.