docs: align published and security guidance

2026-07-29 19:41:53 +10:00
parent 6ddda00eb3
commit df3ce58bd4
5 changed files with 86 additions and 11 deletions
@@ -0,0 +1,41 @@
+# Lildra security review summary
+
+This summary is intended to help Queensland Department of Education reviewers assess Lildra 0.3.1. Lildra is an independent Napper.au project intended to be requested for use by EQ school staff; it is not approved or endorsed by the Queensland Department of Education or any educational institution.
+
+## Scope and architecture
+
+Lildra has one purpose: after an explicit toolbar click or Alt+L command, it provides a distraction-free reading layout on a supported HTTPS Canvas/QLearn course lesson or wiki page. It preserves the native lesson DOM and does not activate on dashboards, assignments, discussions, quizzes, modules, account pages, HTTP pages, or unrelated sites.
+
+The extension checks both the route (`/courses/{course}/pages/{page}` or `/courses/{course}/wiki/{page}`) and expected Canvas DOM elements before making any change. It uses only:
+
+- `activeTab`, for temporary access to the selected tab after explicit user action; and
+- `scripting`, to inject only the packaged `lildra.js` file.
+
+There are no `host_permissions` and no persistent content script or persistent site access. The extension has no dependencies, remote executable code, analytics, telemetry, advertising, tracking, storage APIs, or extension-initiated network APIs.
+
+## Local data flow and cleanup
+
+On activation, Lildra locally checks the selected tab's HTTPS route and Canvas structure, reads the visible lesson title, injects scoped layout CSS and two decorative labels, and observes title changes. It does not retain or transmit lesson content, titles, addresses, or usage information. Canvas, QLearn, and embedded resources continue communicating with their existing providers independently of Lildra.
+
+Activating Lildra again removes its observer, pending animation frame, root class, style element, title bar, version label, and page-scoped state. Closing or navigating away from the page also ends that in-page state.
+
+## Public references
+
+- Website: https://napper.au/lildra
+- Privacy: https://napper.au/lildra/privacy
+- Support: https://napper.au/lildra/support
+- Terms: https://napper.au/lildra/terms
+- Public source: https://git.napper.au/napper/lildra
+- Distribution: Chrome Web Store and Microsoft Edge Add-ons, linked from the Lildra website
+- Vulnerability reporting: [SECURITY.md](../SECURITY.md)
+
+## Manual verification
+
+1. Inspect `manifest.json`; confirm Manifest V3, version 0.3.1, only `activeTab` and `scripting`, and no `host_permissions`.
+2. Load the repository unpacked in current Chrome and Edge and confirm there are no extension errors.
+3. On a representative QLearn lesson, toggle with the toolbar and Alt+L. Confirm navigation hides, native lesson content remains in place, and toggling off restores the page completely.
+4. Confirm unsupported routes and pages missing the expected Canvas DOM do not change.
+5. Inspect browser network activity while toggling and confirm Lildra initiates no requests; separately confirm normal Canvas and embedded-resource requests continue.
+6. Test dynamic titles, narrow and desktop viewports, keyboard use, and screen-reader output.
+
+The fuller privacy disclosure is in [PRIVACY.md](PRIVACY.md), and the complete pre-release manual procedure is in [AGENTS.md](../AGENTS.md).