Garry Tan 929190c588 fix: innerHTML XSS in extension content script and sidepanel (MEDIUM-01) ...

- content.js: replace innerHTML with createElement/textContent for ref panel
- sidepanel.js: escape entry.command with escapeHtml() in activity feed
- Both found by security audit + Codex adversarial red team

2026-03-27 22:13:59 -07:00

..

icons

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

background.js

fix: remove auth token from /health, secure extension bootstrap (CRITICAL-02 + HIGH-03)

2026-03-27 22:13:45 -07:00

content.css

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

content.js

fix: innerHTML XSS in extension content script and sidepanel (MEDIUM-01)

2026-03-27 22:13:59 -07:00

manifest.json

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

popup.html

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

popup.js

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

sidepanel.css

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

sidepanel.html

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)

2026-03-26 11:15:24 -06:00

sidepanel.js

fix: remove auth token from /health, secure extension bootstrap (CRITICAL-02 + HIGH-03)

2026-03-27 22:13:45 -07:00