bookmarks-api/SECURITY.md

Security

This add-on is scoped to bookmarks. Treat a leaked fab_… secret like a password for your bookmark tree: revoke it, then issue a new one.

Boundaries that must stay

• Manifest permissions: bookmarks, storage, nativeMessaging only
• No tabs, history, cookies, <all_urls>, webRequest, or runtime.onMessageExternal
• Host bind: 127.0.0.1 (port defaults to 17634; user-configurable)
• Reject HTTP requests that carry a browser Origin
• Native host allowed_extensions pinned to this gecko id
• Method allowlist in both extension/background.js and host/firefox_agent_bridge_host.py

Reporting

Please open an issue on this repository. Do not attach live secrets or a copy of places.sqlite.