From df3ce58bd4dbb38aa8acea779001e19b137e302a Mon Sep 17 00:00:00 2001 From: Kaden Napper Date: Wed, 29 Jul 2026 19:41:53 +1000 Subject: [PATCH] docs: align published and security guidance --- README.md | 8 +++++- SECURITY.md | 14 ++++++++++ docs/CHROME_WEB_STORE_SUBMISSION.md | 28 +++++++++++++------- docs/PRIVACY.md | 6 ++++- docs/SECURITY_REVIEW.md | 41 +++++++++++++++++++++++++++++ 5 files changed, 86 insertions(+), 11 deletions(-) create mode 100644 SECURITY.md create mode 100644 docs/SECURITY_REVIEW.md diff --git a/README.md b/README.md index a0cb900..1052875 100644 --- a/README.md +++ b/README.md @@ -14,6 +14,8 @@ Lildra is a small Chrome and Edge Manifest V3 extension that gives Canvas/QLearn Lildra requests only `activeTab` and `scripting`. It has no analytics, remote code, settings, popup, or persistent site access. +Lildra is intended to be requested for use by Queensland Department of Education school staff. It is an independent Napper.au project and is not approved or endorsed by the Queensland Department of Education or any educational institution. + ## Install locally 1. Open `chrome://extensions` in Chrome or `edge://extensions` in Edge. @@ -29,4 +31,8 @@ Follow the manual checklist in [AGENTS.md](AGENTS.md). There is no build step an ## Privacy and security -Lildra runs only after an explicit toolbar click or keyboard command. It processes the active supported page locally to provide its focused layout, but does not store or transmit page content. The package contains no analytics or remote scripts. +Lildra runs only after an explicit toolbar click or keyboard command. It processes the selected supported lesson locally to validate the route and Canvas structure, apply its focused layout, and display the lesson title. It does not retain or transmit lesson content, titles, addresses, or usage information. + +The extension has no persistent site access, storage, analytics, telemetry, advertising, tracking, remote code, or extension-initiated network requests. Canvas, QLearn, and embedded lesson resources continue communicating with their existing providers independently of Lildra. + +See the [privacy policy](docs/PRIVACY.md), [security policy](SECURITY.md), and [security review summary](docs/SECURITY_REVIEW.md). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..763207e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,14 @@ +# Security policy + +Report suspected Lildra vulnerabilities privately to [support@napper.au](mailto:support@napper.au) with the subject **Lildra security report**. + +Please include: + +- the Lildra version and browser; +- the affected page type; +- clear reproduction steps; and +- the potential security or privacy impact. + +Do not include passwords, authentication details, student records, or private lesson content. Use a minimal test case or redacted information where possible. + +Please do not disclose a suspected vulnerability publicly before there has been a reasonable opportunity to investigate and respond. diff --git a/docs/CHROME_WEB_STORE_SUBMISSION.md b/docs/CHROME_WEB_STORE_SUBMISSION.md index 8be4d0d..8bdd041 100644 --- a/docs/CHROME_WEB_STORE_SUBMISSION.md +++ b/docs/CHROME_WEB_STORE_SUBMISSION.md @@ -15,6 +15,8 @@ This document is a drafting and validation aid. Compare all privacy answers with - Support URL: https://napper.au/lildra/support - Privacy-policy URL: https://napper.au/lildra/privacy - Homepage: https://napper.au/lildra +- Public source: https://git.napper.au/napper/lildra +- Publication status: publicly listed in the Chrome Web Store and Microsoft Edge Add-ons ### Short description @@ -116,7 +118,7 @@ Browser chrome was cropped to remove the production hostname, course identifiers ## Store icon validation -The 0.3.0 packaged icon was fully opaque and had an unintended white square background. For 0.3.1, the established mark was technically normalised without redesigning it: +The previous packaged icon was fully opaque and had an unintended white square background. For 0.3.1, the established mark was technically normalised without redesigning it: - 128×128 PNG: confirmed. - Alpha transparency and transparent corners: confirmed. @@ -136,18 +138,26 @@ The 0.3.0 packaged icon was fully opaque and had an unintended white square back ## Public website alignment -Confirmed strengths: +Current published alignment: - `/lildra`, `/lildra/privacy`, `/lildra/support`, and `/lildra/terms` are live. - The public pages accurately describe explicit activation, supported page types, lack of persistent host access, local processing, permissions, and independence. - The public privacy page discloses local access to the active URL, title, and Canvas structure. -Required before submission: +- The website displays version 0.3.1 and uses **Local processing only** to explain that the selected lesson is processed in the browser and is not stored or transmitted by Lildra. +- Normal installation links point to the Chrome Web Store and Microsoft Edge Add-ons. +- Version 0.3.1 is publicly listed in both stores. -1. Update visible version references from `0.3.0` to `0.3.1`. -2. On the homepage privacy card, replace **“No data collection”** with **“Local processing only”** and use: “The selected lesson is processed in your browser and is not stored or transmitted by Lildra.” This avoids ambiguity under Chrome's definition of data handling. -3. After Web Store publication, replace release-download installation calls to action with the Chrome Web Store listing. The support page may retain a source/release link as a secondary option. -4. Update support installation instructions after publication so normal users install from the store rather than enabling Developer mode. +Local processing is not the same as handling no website content. Lildra temporarily processes the selected supported page's address, Canvas DOM structure, and visible title on the device. It does not collect that information into an extension dataset, persistently store it, or transmit it. Keep the conservative **Website content: Yes** dashboard disclosure. + +## Microsoft Edge listing alignment + +- [ ] Chrome and Edge detailed descriptions describe the same single purpose and supported routes. +- [ ] Both listings show version 0.3.1. +- [ ] Both listings use https://napper.au/lildra/support as the support URL. +- [ ] Both listings use https://napper.au/lildra/privacy as the privacy-policy URL. +- [ ] Both listings describe local processing without claiming that Lildra handles no website content. +- [ ] Both listings identify the public source at https://git.napper.au/napper/lildra where the dashboard supports it. ## Manual submission and testing checklist @@ -171,9 +181,9 @@ Required before submission: - [ ] Upload the privacy-policy URL and compare every dashboard privacy answer against its current wording. - [ ] Provide any reviewer credentials only through the dashboard's secure field. -## Distribution recommendation +## Published-listing maintenance -Use **Unlisted** for the first controlled beta. The implementation and submission package are narrowly scoped, but representative live QLearn testing, the 0.3.1 public-site wording updates, icon checks in Chrome, and dashboard privacy-category review remain manual. Move to **Public** after those checks pass and the store/support links are aligned. +Version 0.3.1 is publicly listed in the Chrome Web Store and Microsoft Edge Add-ons. Before a future release, repeat the manual testing and dashboard review above, then ensure both stores, the website, privacy policy, support page, terms, and public source remain aligned. Dashboard values and live listing text must be checked manually because they are not controlled by this repository. ## Official references diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index 3bb0500..ac4c63e 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -16,6 +16,8 @@ The active lesson may contain website content or user-generated educational cont Lildra does not seek passwords, authentication cookies, health or financial information, private communications, precise location, or information from unrelated tabs. +Lildra has no persistent site access. Its `activeTab` permission grants temporary access to the selected tab only after the user activates the extension with the toolbar button or keyboard shortcut. + ## Use, storage and retention Information from the selected tab is used only to validate the page, apply the requested focused layout, display its current title, and restore the normal layout when Lildra is disabled. @@ -24,7 +26,7 @@ Lildra does not request Chrome's storage permission and does not use `chrome.sto ## Transmission and sharing -Lildra does not transmit page content, page titles, addresses, or usage information to Napper.au or another service. It contains no analytics, telemetry, advertising, tracking, or remote executable code. Lildra does not sell user information or share it with advertisers, data brokers, or unrelated third parties. +Lildra does not transmit page content, page titles, addresses, or usage information to Napper.au or another service. It contains no analytics, telemetry, advertising, tracking, remote executable code, or extension-initiated network requests. Lildra does not sell user information or share it with advertisers, data brokers, or unrelated third parties. Canvas, QLearn, and embedded lesson resources continue to communicate with their existing providers independently of Lildra. @@ -51,3 +53,5 @@ This policy may be updated if Lildra's features, permissions, or data practices ## Contact Privacy questions and deletion requests can be sent to [support@napper.au](mailto:support@napper.au). Lildra is an independent Napper.au project based in Queensland, Australia. + +Lildra is intended to be requested for use by Queensland Department of Education school staff. The project is not approved or endorsed by the Queensland Department of Education or any educational institution. diff --git a/docs/SECURITY_REVIEW.md b/docs/SECURITY_REVIEW.md new file mode 100644 index 0000000..b0964c7 --- /dev/null +++ b/docs/SECURITY_REVIEW.md @@ -0,0 +1,41 @@ +# Lildra security review summary + +This summary is intended to help Queensland Department of Education reviewers assess Lildra 0.3.1. Lildra is an independent Napper.au project intended to be requested for use by EQ school staff; it is not approved or endorsed by the Queensland Department of Education or any educational institution. + +## Scope and architecture + +Lildra has one purpose: after an explicit toolbar click or Alt+L command, it provides a distraction-free reading layout on a supported HTTPS Canvas/QLearn course lesson or wiki page. It preserves the native lesson DOM and does not activate on dashboards, assignments, discussions, quizzes, modules, account pages, HTTP pages, or unrelated sites. + +The extension checks both the route (`/courses/{course}/pages/{page}` or `/courses/{course}/wiki/{page}`) and expected Canvas DOM elements before making any change. It uses only: + +- `activeTab`, for temporary access to the selected tab after explicit user action; and +- `scripting`, to inject only the packaged `lildra.js` file. + +There are no `host_permissions` and no persistent content script or persistent site access. The extension has no dependencies, remote executable code, analytics, telemetry, advertising, tracking, storage APIs, or extension-initiated network APIs. + +## Local data flow and cleanup + +On activation, Lildra locally checks the selected tab's HTTPS route and Canvas structure, reads the visible lesson title, injects scoped layout CSS and two decorative labels, and observes title changes. It does not retain or transmit lesson content, titles, addresses, or usage information. Canvas, QLearn, and embedded resources continue communicating with their existing providers independently of Lildra. + +Activating Lildra again removes its observer, pending animation frame, root class, style element, title bar, version label, and page-scoped state. Closing or navigating away from the page also ends that in-page state. + +## Public references + +- Website: https://napper.au/lildra +- Privacy: https://napper.au/lildra/privacy +- Support: https://napper.au/lildra/support +- Terms: https://napper.au/lildra/terms +- Public source: https://git.napper.au/napper/lildra +- Distribution: Chrome Web Store and Microsoft Edge Add-ons, linked from the Lildra website +- Vulnerability reporting: [SECURITY.md](../SECURITY.md) + +## Manual verification + +1. Inspect `manifest.json`; confirm Manifest V3, version 0.3.1, only `activeTab` and `scripting`, and no `host_permissions`. +2. Load the repository unpacked in current Chrome and Edge and confirm there are no extension errors. +3. On a representative QLearn lesson, toggle with the toolbar and Alt+L. Confirm navigation hides, native lesson content remains in place, and toggling off restores the page completely. +4. Confirm unsupported routes and pages missing the expected Canvas DOM do not change. +5. Inspect browser network activity while toggling and confirm Lildra initiates no requests; separately confirm normal Canvas and embedded-resource requests continue. +6. Test dynamic titles, narrow and desktop viewports, keyboard use, and screen-reader output. + +The fuller privacy disclosure is in [PRIVACY.md](PRIVACY.md), and the complete pre-release manual procedure is in [AGENTS.md](../AGENTS.md).