Skip to content

Security: TheFractalyst/PineOptimizer

Security

.github/SECURITY.md

PineOptimizer Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it responsibly.

Email: security@fractalyst.dev

Do not open a public GitHub issue for security vulnerabilities.

Expect a response within 48 hours.

Scope

This extension interacts with the TradingView web application via DOM manipulation in your browser. Security concerns in scope include:

  • Code injection via crafted extension inputs
  • XSS vulnerabilities in the in-page overlay UI
  • Unintended data exposure through extension outputs
  • Credential or session token leakage
  • Vulnerabilities in the content scripts or popup that could be exploited

Out of Scope

  • TradingView's own security (report to TradingView directly)
  • Chrome or Chromium security (report to Google)
  • Chrome Web Store platform security (report to Google)

Security Architecture

This extension is designed with security as a priority:

  • No remote code execution: No eval(), no new Function(), no remote script loading
  • No external network requests: All processing happens locally in the browser
  • No data collection: No analytics, no tracking, no telemetry sent to any server
  • Local storage only: All data stored in chrome.storage.local (never leaves the browser)
  • CSP compliant: No inline event handlers, all listeners attached via addEventListener
  • Minimal permissions: Only activeTab and storage requested
  • XSS prevention: dom.js provides HTML escaping utilities for all user-facing content

Permissions Justification

Permission Why it's needed
activeTab Interact with TradingView's DOM to read/set strategy parameters
storage Save optimization results, presets, and user settings locally
://.tradingview.com/* Content scripts run only on TradingView charts

No other permissions are requested. The extension does not need tabs, cookies, webRequest, history, or any other host permissions.

Best Practices for Users

  • Only install from the Chrome Web Store or build from source
  • Do not modify the extension to add external network calls
  • Keep your Chrome browser up to date
  • Review the permissions before installing - this extension only requests activeTab and storage

There aren't any published security advisories