Security Policy

Reporting a vulnerability

Open a private security advisory on the GitHub repository:

1. Go to github.com/khageshgopalpatel/syncmock → Security → Advisories → New.
2. Describe the vulnerability, its potential impact, and steps to reproduce.
3. Include the extension version and Chrome version you tested against.

We aim to acknowledge reports within 3 business days and ship a fix or mitigation within 14 days for high-severity issues.

Scope

In scope

• Extension service worker, popup, dashboard, content scripts, page-bridge
• Rule engine and rule validation logic
• Network capture pipeline and message router
• Storage read/write handlers
• AI settings storage and key handling

Out of scope

• Third-party AI endpoints you configure (governed by their own security policies)
• Vulnerabilities in Chrome or Chromium itself
• Attacks that require physical access to the user's unlocked device
• Social engineering of users

Supported versions

Only the latest published version receives security fixes. Older versions are not maintained. We recommend always running the latest version installed from the Chrome Web Store.

Threat model highlights

• Syncmock requires broad <all_urls> host permissions because user-defined rules can target any origin. No access is exercised until a matching rule exists.
• Rule bodies are treated as inert strings. They are never evaluated as JavaScript. Mock response bodies are returned as-is to the page.
• Rule imports are validated against a strict schema before merging into storage.
• The AI feature never sees traffic that is not explicitly selected by the user.
• The extension does not execute any remotely fetched code.