# Security and privacy

casidora is designed as a local-first Chrome extension. This document explains its current security posture and how to report a concern.

## Current security design

- The extension uses Chrome Manifest V3.
- The current `manifest.json` declares no Chrome permissions.
- The calculator engine performs calculations locally and does not require a remote backend.
- The extension is not designed to read the contents of the active tab.
- User preferences and calculator state may be stored in browser-local storage.
- The project currently declares no third-party runtime dependencies in `package.json`.

These statements describe the checked-in project configuration; review the source at the version you install. Future changes can alter the security and privacy characteristics.

## Safe installation

- Install from the project's official repository once its address is published; avoid unofficial repackaged downloads.
- Inspect the source and `manifest.json` before loading an unpacked build.
- Keep Chrome and your operating system updated.
- Do not install a modified build from an untrusted person or source.
- Treat calculator expressions and saved values as potentially sensitive if someone else can access your browser profile.

## Reporting a vulnerability

Please do not publish exploitable vulnerability details in a public issue before maintainers have had a reasonable opportunity to investigate.

Until a private security contact is published, use the repository's private vulnerability-reporting feature (if enabled). If it is not enabled, contact the maintainers through a trusted channel listed by the repository owner and share only the minimum details needed to reproduce the issue. Do not include passwords, personal data, or unrelated private information.

A useful report includes:

- A concise description and potential impact.
- Affected casidora version, Chrome version, and operating system.
- Reproduction steps or a minimal proof of concept.
- Any suggested mitigation, if known.

Maintainers should acknowledge reports, investigate, coordinate a fix, and publish an advisory when appropriate. No response-time guarantee is made until a formal security response policy and contact are established.

## Scope

This policy covers the casidora extension source and official project distribution. It does not cover vulnerabilities in Chrome, the operating system, or third-party software except where casidora's integration creates the issue.