# Security

wayBetter for X runs next to your signed-in X session, so security reports are taken seriously.

## Reporting a vulnerability

Please do **not** open a public issue. Send the details privately to **hi@crt.fyi** (or a direct
message to [@CRTkafa](https://x.com/CRTkafa)): what an attacker can do, the steps to reproduce and the
affected version. You'll get an answer as soon as possible, and credit in the fix notes if you want it.

## What the app is designed to guarantee

- The X page never gets access to privileged native commands. Each X tab may only call a small,
  audited set (report its own URL/title, capture a draft append-only, open the panel, show a local
  notification for your own keywords, and a few read-only helpers). Everything else is limited to the
  app's own local shell.
- Accounts live in separate WebView profiles. One account's tab cannot act for another.
- Updates are signed; the app refuses an update or hotfix whose signature does not verify, and a
  store catalog whose signature does not verify.
- No telemetry about what you read or post. No DM capture.

## Plugins and custom CSS

Plugins (`*.plugin.js`) and custom CSS run inside the X page with the same access as the page itself.
Install only code you trust, the same way you would with a browser extension. Themes are data: they
are sanitized field by field, and only their optional `css` field carries the custom-CSS trust level.

Plugin permissions (`@permissions storage, ui, network:none`) limit what the wayBetter plugin API
gives a plugin, and undeclared calls throw. They are **not** a sandbox: JavaScript in the page can
read and change the page, make requests and reach around any check made in the page. Treat them as
a declaration to review, not a guarantee. Plugins without the line are labelled "legacy, full page
access".

## Installing themes and plugins

Besides copying files into the plugins folder, themes and plugins can be installed from a dropped
file, a `waybetter://install` link or the wayBetter Store. Every one of these shows an install
screen in the app's own window first (name, author, version, source, SHA-256, permissions, the code
or CSS); nothing is installed until you confirm there. Web pages and X tabs cannot install anything:
a link only opens that screen. Links may only point at https URLs on waybetter.fyi, cdn1.crt.fyi or
git.crt.fyi (raw files), with size caps; the app downloads them itself without redirects or
cookies. The store catalog is signed with an Ed25519 key kept offline; the app checks the signature
and every download's SHA-256 against it. Details: `docs/STORE.md`.