Security Policy

Reporting a vulnerability

Email [email protected] with the subject line “Security report” and include:

1. A description of the vulnerability, its potential impact, and steps to reproduce.
2. The extension version and Chrome version you tested against.
3. Any proof-of-concept code or screenshots that help demonstrate the issue.

We aim to acknowledge reports within 3 business days and ship a fix or mitigation within 14 days for high-severity issues.

Scope

In scope

• Extension service worker, popup, dashboard, content scripts, page-bridge
• Rule engine and rule validation logic
• Network capture pipeline and message router
• Storage read/write handlers
• AI settings storage and key handling

Out of scope

• Third-party AI endpoints you configure (governed by their own security policies)
• Vulnerabilities in Chrome or Chromium itself
• Attacks that require physical access to the user's unlocked device
• Social engineering of users

Supported versions

Only the latest published version receives security fixes. Older versions are not maintained. We recommend always running the latest version installed from the Chrome Web Store.

Threat model highlights

• Syncmock requires broad <all_urls> host permissions because user-defined rules can target any origin. No access is exercised until a matching rule exists.
• Rule bodies are treated as inert strings. They are never evaluated as JavaScript. Mock response bodies are returned as-is to the page.
• Rule imports are validated against a strict schema before merging into storage.
• The AI feature never sees traffic that is not explicitly selected by the user.
• The extension does not execute any remotely fetched code.