If you discover a security vulnerability in this project, please report it responsibly.
Email: security@fractalyst.dev
Do not open a public GitHub issue for security vulnerabilities.
Expect a response within 48 hours.
This extension interacts with the TradingView web application via DOM manipulation in your browser. Security concerns in scope include:
- Code injection via crafted extension inputs
- XSS vulnerabilities in the in-page overlay UI
- Unintended data exposure through extension outputs
- Credential or session token leakage
- Vulnerabilities in the content scripts or popup that could be exploited
- TradingView's own security (report to TradingView directly)
- Chrome or Chromium security (report to Google)
- Chrome Web Store platform security (report to Google)
This extension is designed with security as a priority:
- No remote code execution: No eval(), no new Function(), no remote script loading
- No external network requests: All processing happens locally in the browser
- No data collection: No analytics, no tracking, no telemetry sent to any server
- Local storage only: All data stored in chrome.storage.local (never leaves the browser)
- CSP compliant: No inline event handlers, all listeners attached via addEventListener
- Minimal permissions: Only activeTab and storage requested
- XSS prevention: dom.js provides HTML escaping utilities for all user-facing content
| Permission | Why it's needed |
|---|---|
| activeTab | Interact with TradingView's DOM to read/set strategy parameters |
| storage | Save optimization results, presets, and user settings locally |
| ://.tradingview.com/* | Content scripts run only on TradingView charts |
No other permissions are requested. The extension does not need tabs, cookies, webRequest, history, or any other host permissions.
- Only install from the Chrome Web Store or build from source
- Do not modify the extension to add external network calls
- Keep your Chrome browser up to date
- Review the permissions before installing - this extension only requests activeTab and storage