adlee-was-taken 2ff3ab1d7f feat(ext): drop setup.html / wasm from web_accessible_resources (audit C1) ...

setup.html is opened via chrome.tabs.create using a chrome-extension:// URL
which doesn't require WAR. WASM is bundled into service-worker.js/setup.js
and never fetched from a web page origin. Leaving them in WAR would expose
their URLs to any origin for probing/fingerprinting; shipping an empty WAR
array closes the surface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-20 20:33:09 -04:00

983 B

Raw Blame History

View Raw