mirror of
https://github.com/FauxxYT/StreamXR.git
synced 2026-10-23 12:00:44 +02:00
29 lines
1.2 KiB
Markdown
29 lines
1.2 KiB
Markdown
# Security
|
|
|
|
StreamXR runs on YouTube pages while you're signed in, and it makes requests to YouTube as
|
|
you (for Subscribe, Like and your feeds). The optional Skip Helper uses Chrome's `debugger`
|
|
permission. So security problems matter here, even in a small project.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please don't open a public issue.** Use GitHub's private reporting instead: the
|
|
repository's **Security** tab -> **Report a vulnerability**. Include what an attacker could
|
|
do, the steps to reproduce, and the StreamXR (and Skip Helper) version.
|
|
|
|
You'll get a reply as soon as the maintainer can; this is a one-person hobby project, so
|
|
please allow some time. Once a fix is released, the report can be made public, with credit
|
|
if you'd like.
|
|
|
|
## What counts
|
|
|
|
For example:
|
|
|
|
- A web page or another extension getting StreamXR to make requests to YouTube as the user,
|
|
or reading the user's YouTube data through it.
|
|
- Anything that makes the Skip Helper act outside its one job (pressing YouTube's visible
|
|
Skip ad button in the tab that asked) or on a tab that isn't youtube.com.
|
|
- StreamXR or the Skip Helper needing, or quietly using, more permissions than the
|
|
manifests list.
|
|
|
|
Bugs that only affect how videos look or play are ordinary issues: use the forms.
|