From e61ee85885a1ee0534ac9b5fa4716ad90e666b38 Mon Sep 17 00:00:00 2001 From: Kaden Napper Date: Wed, 29 Jul 2026 19:30:58 +1000 Subject: [PATCH] docs: add security and store review guidance --- SECURITY.md | 18 ++++ docs/CHROME_WEB_STORE_SUBMISSION.md | 149 ++++++++++++++++++++++++++++ docs/PRIVACY.md | 47 +++++++++ 3 files changed, 214 insertions(+) create mode 100644 SECURITY.md create mode 100644 docs/CHROME_WEB_STORE_SUBMISSION.md create mode 100644 docs/PRIVACY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3042897 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Hudra Security Policy + +Please report suspected Hudra vulnerabilities privately by emailing +support@napper.au with the subject **Hudra security report**. + +Include: + +- the Hudra version and browser version; +- the affected feature; +- clear reproduction steps; and +- the potential security or privacy impact. + +Do not include passwords, authentication details, student records or private +lesson content. Use a minimal synthetic example if content is needed to explain +the issue. + +Please do not disclose a suspected vulnerability publicly before the Hudra +maintainers have had a reasonable opportunity to investigate and respond. diff --git a/docs/CHROME_WEB_STORE_SUBMISSION.md b/docs/CHROME_WEB_STORE_SUBMISSION.md new file mode 100644 index 0000000..a06ac51 --- /dev/null +++ b/docs/CHROME_WEB_STORE_SUBMISSION.md @@ -0,0 +1,149 @@ +# Chrome Web Store submission — Hudra 0.10 Beta 1 + +Prepared: 29 July 2026 + +## Package + +- Product name: `Hudra` +- Manifest version: `3` +- Extension version: `0.10.0` +- Display version: `0.10 Beta 1` +- Existing package: `release/Hudra-v0.10.0.zip` +- This documentation update does not require a new package upload or build. +- Primary category: `Productivity` +- Language: `English (Australia)` if available; otherwise `English` + +## Short description + +Turn structured QLearn and Canvas lessons into clear classroom presentations with presenter and audience views. + +## Detailed description + +Hudra turns structured QLearn and Canvas lesson pages into clear, classroom-ready presentations. + +Open a supported lesson and launch Hudra from the browser toolbar or with Alt+P. Hudra converts the existing page into a slide-style teaching experience without requiring the lesson to be rebuilt in separate presentation software. + +Features include: +• Dedicated presenter and audience views +• Current and next slide previews +• Keyboard and on-screen navigation +• Classroom clock and timer +• Dual-screen presentation support +• Audience zoom and scrolling controls +• Support for structured lesson content and embedded media +• Quick restoration of the original lesson page when presenting ends + +Hudra processes lesson content and generated slide previews temporarily in browser memory to provide the requested presentation. Lesson content and previews are not written to extension storage or transmitted to Napper.au. + +Hudra stores only temporary presentation-session metadata, such as presentation mode and tab and window identifiers, in session-scoped browser storage. This information coordinates and restores an active presentation and is cleared when the browser session ends. + +Hudra requires no account and contains no advertising, analytics, telemetry, tracking or remote executable code. + +Hudra is an independent project and is not affiliated with or endorsed by Instructure or the Queensland Department of Education. + +Support: https://napper.au/hudra/support +Privacy policy: https://napper.au/hudra/privacy +Terms of use: https://napper.au/hudra/terms +Source code: https://git.napper.au/napper/hudra + +## Single purpose + +Hudra converts the active supported QLearn or Canvas lesson page into a temporary, reversible classroom presentation with presenter and audience controls. + +## Permission justifications + +### `activeTab` + +Provides temporary, user-invoked access after the toolbar click or keyboard shortcut. Hudra uses it to inspect the selected page and either start presentation mode or display an unsupported-page notice. + +### `scripting` + +Injects only packaged page-detection and presentation code into the user-selected supported page. No remote code is downloaded or executed. + +### `storage` + +Stores temporary active-presentation metadata in `chrome.storage.session` so presenter and audience windows can remain coordinated and the session can recover if the extension service worker restarts. Lesson content is not persisted. + +### `system.display` + +Detects available displays so Hudra can place presenter and audience windows correctly for dual-screen classroom presentation. + +### Host permissions + +`https://*.qlearn.eq.edu.au/*` and `https://*.instructure.com/*` provide access only on supported QLearn and Canvas lesson hosts. This access is particularly required for the newly created dual-screen audience tab because the original tab's `activeTab` grant does not transfer to that new tab. Hudra still activates only after an explicit toolbar click or keyboard shortcut and does not activate on unrelated websites. + +## Privacy practices answers + +- Handles website content: `Yes` — lesson content and generated previews are processed temporarily in browser memory to create the requested presentation. +- Handles web browsing activity: select only if the dashboard defines access to the active lesson URL/page as browsing activity. Hudra does not collect or transmit browsing history. +- Personally identifiable information: `No`, unless future functionality deliberately reads or retains such information. +- Authentication information: `No` — Hudra does not read or transmit credentials or authentication cookies. +- Financial, health, personal communications, location or form data: `No`. +- Data sold to third parties: `No`. +- Data used for advertising or creditworthiness: `No`. +- Data transmitted off the device by Hudra: `No`. Existing lesson and embedded resources continue to load from their original providers. +- Limited Use certification: certify after confirming these answers match the dashboard wording. + +Privacy policy URL required: publish `docs/PRIVACY.md` at a stable public HTTPS URL, then enter that URL in the dashboard. + +## Graphic assets + +Upload screenshots in this order: + +1. `store-assets/ready-to-upload/01-start-with-qlearn.png` +2. `store-assets/ready-to-upload/02-present-on-one-screen.png` +3. `store-assets/ready-to-upload/03-clean-audience-view.png` +4. `store-assets/ready-to-upload/04-presenter-dashboard.png` +5. `store-assets/ready-to-upload/05-before-and-after.png` + +Additional assets: + +- Store icon: `store-assets/ready-to-upload/store-icon-128.png` +- Small promotional tile: `store-assets/ready-to-upload/small-promo-440x280.png` +- Optional marquee: `store-assets/ready-to-upload/marquee-promo-1400x560.png` + +## Distribution recommendation + +For the first beta, use `Unlisted` visibility if testing with a controlled teacher group. Use `Public` only when the support and privacy-policy URLs are live and representative QLearn manual testing is complete. + +## Reviewer notes + +Hudra works only on supported QLearn and Canvas lesson pages. To test it, open a structured lesson page under one of the declared host patterns, click the Hudra toolbar icon, and use the on-screen controls or keyboard navigation. Dual-screen Presenter View requires a second display; single-screen mode can be tested with one display. + +Hudra does not modify or save the source lesson. Exiting presentation mode restores the normal page. + +If the reviewer cannot access a QLearn environment, provide a test Canvas/Instructure lesson URL and test account through the dashboard's secure reviewer-instructions field. Do not place credentials in this document or in the extension package. + +## Manual checks before submission + +- Test activation and exit on representative QLearn and Canvas lesson pages. +- Confirm unsupported pages show a clear message and remain unchanged. +- Test previous, next, first and last navigation. +- Test Escape and the toolbar button restore the original page. +- Test dual-screen window placement with an attached second display. +- Test audience zoom, scroll, hide and video controls. +- Confirm the privacy-policy and support URLs are publicly accessible. +- Confirm the screenshots contain no private production lesson or student information. + +## Dashboard fields to review for the existing 0.10 Beta 1 application + +Chrome Web Store: + +- **Package**: do not upload a new package; retain the existing 0.10.0 submission. +- **Store listing > Detailed description**: replace with the exact detailed description above. +- **Store listing > Short description**: use the short description above. +- **Privacy > Single purpose description**: use the single-purpose statement above. +- **Privacy > Permission justifications**: update `activeTab`, `scripting`, `storage`, `system.display` and host-permission explanations to the text above. +- **Privacy > Data usage**: declare website content processing; confirm lesson content/previews are memory-only, session metadata is session-scoped, and no data is sold, used for advertising or transmitted to Napper.au. +- **Privacy policy URL**: `https://napper.au/hudra/privacy`. +- **Support URL**: `https://napper.au/hudra/support`. +- **Distribution** and **Test instructions**: retain the intended visibility and update reviewer notes if the supplied test lesson/account changes. + +Microsoft Edge Add-ons: + +- **Package**: do not upload a new package; retain the existing 0.10.0 submission. +- **Properties > Description** and **Short description**: use the exact detailed and short descriptions above. +- **Properties > Version notes**: no version-note change is required because this is supporting documentation for the existing build. +- **Privacy policy URL**: `https://napper.au/hudra/privacy`. +- **Support website**: `https://napper.au/hudra/support`. +- **Notes for certification**: use the reviewer notes above and provide any test account only through the dashboard's secure field. diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md new file mode 100644 index 0000000..fa7fed3 --- /dev/null +++ b/docs/PRIVACY.md @@ -0,0 +1,47 @@ +# Hudra Privacy Policy + +Effective date: 29 July 2026 + +Hudra is a browser extension that turns supported QLearn and Canvas lesson pages into a classroom presentation. Hudra processes lesson page content locally in the user's browser to provide this feature. + +## Information Hudra handles + +When the user starts Hudra, the extension reads the content and structure of the active supported lesson page. This website content may contain information entered into or displayed by QLearn or Canvas. Lesson content and generated current/next slide previews are processed temporarily in browser memory during the active presentation. + +Hudra keeps only temporary presentation-session metadata in `chrome.storage.session`, including the presentation mode and presentation tab and window identifiers. This metadata coordinates and restores an active presentation and is cleared when the browser session ends. + +## How information is used + +Lesson page content is used only to generate and display the presentation requested by the user. Temporary session information is used only to coordinate presenter and audience windows and restore the normal lesson page when presentation mode closes. + +## Collection, transmission and sharing + +Hudra does not transmit lesson content or generated slide previews to Napper.au. It does not transmit browsing activity, credentials, personal information or presentation-session metadata to Napper.au or other third parties. + +Hudra includes no advertising, analytics, telemetry, tracking or remote executable code. It does not sell or share user data. + +Existing lesson resources, such as images, videos and embedded media, continue to load from the original providers referenced by the lesson page. Hudra does not proxy those resources through Napper.au. + +## Storage and retention + +Hudra does not write lesson content or generated slide previews to `chrome.storage`. Active presentation metadata is stored only in Chrome's session-scoped extension storage and is not synchronized to external services. + +## Permissions + +- `activeTab` provides temporary access after a toolbar click or keyboard shortcut so Hudra can inspect the selected page or show an unsupported-page notice. +- `scripting` injects only packaged page-detection and presentation code. +- `storage` holds temporary session metadata only, using `chrome.storage.session`. +- `system.display` detects displays for presenter and audience window placement. +- QLearn and Instructure host access permits Hudra to run on supported lesson pages. It is particularly required for a newly created dual-screen audience tab because the original tab's `activeTab` grant does not transfer to that tab. + +Hudra activates only after an explicit toolbar click or keyboard shortcut. + +## Changes to this policy + +If Hudra's data practices change, this policy and the Chrome Web Store privacy disclosures will be updated before the changed version is published. + +## Contact + +Privacy questions can be submitted through the support link on Hudra's Chrome Web Store listing. + +The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.