Security

Design

Static files only; no server runtime, database or API keys. A strict Content-Security-Policy is recommended (see deploy files). The service worker caches the app shell for offline use.

Known Limits

The hash chain is tamper-evident, not tamper-proof; anyone controlling the browser profile can rewrite local storage. The extension cannot see other apps, iframes, shadow-DOM-closed inputs or direct network calls, and sites may bypass form events. A PWA cannot intercept other tabs.

Reporting

Report vulnerabilities privately to the site operator.

Last updated: 6 November 2026. Starter text — have it reviewed for your actual operations before public launch.