43 lines
2.6 KiB
Markdown
43 lines
2.6 KiB
Markdown
# Security
|
|
|
|
wayBetter for X runs next to your signed-in X session, so security reports are taken seriously.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please do **not** open a public issue. Send the details privately to **hi@crt.fyi** (or a direct
|
|
message to [@CRTkafa](https://x.com/CRTkafa)): what an attacker can do, the steps to reproduce and the
|
|
affected version. You'll get an answer as soon as possible, and credit in the fix notes if you want it.
|
|
|
|
## What the app is designed to guarantee
|
|
|
|
- The X page never gets access to privileged native commands. Each X tab may only call a small,
|
|
audited set (report its own URL/title, capture a draft append-only, open the panel, show a local
|
|
notification for your own keywords, and a few read-only helpers). Everything else is limited to the
|
|
app's own local shell.
|
|
- Accounts live in separate WebView profiles. One account's tab cannot act for another.
|
|
- Updates are signed; the app refuses an update or hotfix whose signature does not verify, and a
|
|
store catalog whose signature does not verify.
|
|
- No telemetry about what you read or post. No DM capture.
|
|
|
|
## Plugins and custom CSS
|
|
|
|
Plugins (`*.plugin.js`) and custom CSS run inside the X page with the same access as the page itself.
|
|
Install only code you trust, the same way you would with a browser extension. Themes are data: they
|
|
are sanitized field by field, and only their optional `css` field carries the custom-CSS trust level.
|
|
|
|
Plugin permissions (`@permissions storage, ui, network:none`) limit what the wayBetter plugin API
|
|
gives a plugin, and undeclared calls throw. They are **not** a sandbox: JavaScript in the page can
|
|
read and change the page, make requests and reach around any check made in the page. Treat them as
|
|
a declaration to review, not a guarantee. Plugins without the line are labelled "legacy, full page
|
|
access".
|
|
|
|
## Installing themes and plugins
|
|
|
|
Besides copying files into the plugins folder, themes and plugins can be installed from a dropped
|
|
file, a `waybetter://install` link or the wayBetter Store. Every one of these shows an install
|
|
screen in the app's own window first (name, author, version, source, SHA-256, permissions, the code
|
|
or CSS); nothing is installed until you confirm there. Web pages and X tabs cannot install anything:
|
|
a link only opens that screen. Links may only point at https URLs on waybetter.fyi, cdn1.crt.fyi or
|
|
git.crt.fyi (raw files), with size caps; the app downloads them itself without redirects or
|
|
cookies. The store catalog is signed with an Ed25519 key kept offline; the app checks the signature
|
|
and every download's SHA-256 against it. Details: `docs/STORE.md`.
|