GitQuiet runs inside github.com with the session you are already signed in with, and it reads and writes your repositories through GitHub's own routes and API. A flaw here reaches whatever your GitHub account reaches, so reports are taken seriously.
Use GitHub's private vulnerability reporting:
That form is private between you and the maintainer until a fix is published. Please do not open a public issue for a security problem.
Include what you have: the version, the browser, the page it happens on, and the smallest sequence that shows it. A proof of concept helps and is not required.
You should get a first reply within seven days. If a report is confirmed, you will be credited in the advisory unless you would rather not be.
The version published on the Chrome Web Store, and main. There are no
maintained older branches.
| In scope | Out of scope |
|---|---|
| Code injected into a github.com page | Bugs in github.com itself, which belong to GitHub |
| The content script, the worker and their messaging | Findings from a modified or unofficial build |
Anything reachable from storage.local |
Reports produced only by a scanner, with no working case |
The permissions in wxt.config.ts |
Anything that needs an already compromised machine |
| Data leaving the browser when it should not | Social engineering of the maintainer or of users |
There is no account and no server of ours. Your code, reviews and tokens stay in the browser. Every write goes back through GitHub.
There is no error reporting service and no third-party endpoint of any kind. A
failure this extension carries on through is written to the browser's own
console and nowhere else. See
src/observability/report.ts, which is the
whole of it.