Browser extensions

Required

• Ask for the fewest permissions the extension needs

  DSK-14

  Request only permissions the extension uses, and prefer activeTab to host permissions. Put features that a minority of users turn on under optional_permissions or optional_host_permissions, asked for when the user starts them.

• Ship every line of code inside the package

  DSK-15

  Build on Manifest V3 and run only code that is inside the submitted package. Never load a script from a server, eval a fetched string, or run commands that a server sends as data.

Recommended

• Treat messages from web pages and content scripts as untrusted

  DSK-16

  Validate every message the background script receives, and check its sender before acting. Let web pages message the extension only from hosts listed under externally_connectable.

• Keep extension state in storage instead of the background worker

  DSK-17

  Save every value the extension needs later with storage or IndexedDB, and register event listeners at the top level of the background script. Never keep state only in global variables.

• Declare data use truthfully in each store

  DSK-18

  Fill in the Chrome Web Store privacy practices form and Firefox's data_collection_permissions from one list of the data the extension sends. Link a privacy policy that says the same.

• Protect the store accounts that publish the extension

  DSK-19

  Publish from a group or organisation account, never one person's account. Every person on it signs in with a phishing-resistant second factor, and uploads come from CI.