FocusTube interacts with how you browse, so it holds itself to a published standard. This page summarizes the repository's SECURITY.md — the threat model, the hardening history, and the honest limitations. No unverifiable claims.
What FocusTube does
- Computes your Focus Score, rings and analytics on-device
- Reads public page DOM on sites you browse (required for blocking)
- Stores history and settings in chrome.storage.local on your machine
- Writes plain JSON archives only to a folder you explicitly pick
- Sends AI summary requests straight from your browser to your chosen provider, using your key
- Validates every internal message payload before handling it
What it deliberately doesn't
- Operates any server, account, or telemetry pipeline — there is nothing to send data to
- Reads your private Google/YouTube account data — no account scopes are requested
- Includes API keys, passwords or emails in sync or export files — explicitly excluded
- Logs your API keys — they are redacted from all log output
- Phones home on install, update, or uninstall — there is no endpoint
- Shares anything with third parties — there is no one to share with
Requested in manifest.json, verbatim. If a permission loses its justification, it loses its place in the manifest.
storageAll settings, history and ring data live in chrome.storage.local on your device.tabsTime tracking, tab manager workspaces and applying blocks to the right tab.scriptingInjecting the blocking and UI logic into pages you visit.activeTabActing on the page you're on when you invoke the popup.tabGroupsTab Manager workspaces and grouping.notificationsLocal reminders — wind-down briefing, session ends. No remote pushes.declarativeNetRequestBlocking ad/tracking network requests efficiently, without reading page data.idleAuto-pause on inactivity — stop counting time when you've stepped away.alarmsScheduled blocks, sync ticks and archive rotation.Where the trust boundaries are.
SECURITY.md names three: the pages FocusTube runs on (hostile by assumption), the messages passed between popup, worker and content scripts (validated at every boundary), and anything that ever renders as HTML (escaped, always). The AI pipeline is treated as untrusted input too — provider output is HTML-escaped before it ever touches the page.
Known limitation, stated honestly: FocusTube reads public page DOM by design and cannot protect anything outside the browser. Selector drift on YouTube is the main maintenance cost and is tracked openly.
Fixed, documented, kept fixed.
- XSS via AI summary content — HTML-escaped (v1.0.1, HIGH)
- XSS via stored domains, avatars and keyword overlays — DOM APIs instead of HTML strings
- Message payloads — validated before any handler runs
- API keys — redacted from every log path
- web_accessible_resources — tightened to the minimum surface
- Overlay re-creation and listener duplication — stability passes with tests-by-hand documented
Found something? Report it. The policy asks for details by GitHub issue or the contacts on this site — and fixes have historically shipped in days, with credit.
Read the full SECURITY.md