This project is in early development. Security fixes are applied to the latest version on the main branch. There are no long-term-support branches yet.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report it privately using GitHub's private vulnerability reporting: go to the repository's Security tab and click Report a vulnerability.

Please include:

• A description of the issue and its potential impact.
• Steps to reproduce, or a proof of concept.
• The affected version / commit and your browser + version.

You can expect an initial response within a few days. Once the issue is confirmed, we'll work on a fix and coordinate a disclosure timeline with you.

This is a client-side browser extension with no backend of its own (the only network requests are video thumbnails loaded from YouTube's image CDN). The most relevant concerns are:

• Handling of YouTube page content (the extension stores and re-inserts feed HTML, and stores a log of seen videos, via chrome.storage.local).
• Extension permissions (storage, host access to youtube.com).

Thank you for helping keep the project and its users safe.