Skip to main content

​
Reporting Security Vulnerabilities

Please report security vulnerabilities privately.Do NOT open public issues for security vulnerabilities.

Email

security@contextfort.ai

GitHub

Use Private Vulnerability Reporting

​
What to Include

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

​
Response Timeline

1

Initial Response

Within 48 hours of report
2

Status Update

Within 5 business days
3

Fix Timeline

Based on severity:
  • Critical: 1-3 days
  • High: 1 week
  • Medium: 2 weeks
  • Low: 1 month

​
Supported Versions

​
Security Update Process

1

Vulnerability Reported

Via email or private GitHub report
2

Assessment

Security team evaluates severity and impact
3

Fix Development

Patch developed and tested
4

Release

Security update pushed to Chrome Web Store
5

Disclosure

Public disclosure after fix is deployed (coordinated disclosure)

​
Security Features

​
Current Implementation

ContextFort is designed with security-first architecture and local-first processing.

Local Storage Only

No data transmitted to external servers

No Cloud Dependencies

All processing happens in-browser

Content Security Policy

Strict CSP prevents XSS attacks

Minimal Permissions

Only required permissions requested

Open Source

Full code audit available on GitHub

Manifest V3

Latest Chrome extension security standards

​
Data Security

  • Stored locally in Chrome storage
  • Encrypted at rest by Chrome
  • Never transmitted externally

​
Third Party Dependencies

​
Runtime Dependencies

  • Purpose: Optional usage analytics
  • Can be disabled: Yes, with one line change
  • Data transmitted: Event names and timestamps only (no PII)
  • Security: SOC2 compliant vendor

​
Security Scanning

Dependabot

Automated dependency vulnerability scanning

Regular Audits

Security audits of all dependencies

Prompt Updates

Quick response to known vulnerabilities

​
Compliance

​
Current Status

See the Compliance page for detailed roadmap.

​
Code Security

​
Repository Security

  • Protected main branch
  • Pull request reviews required
  • Status checks must pass

​
Extension Security

Manifest V3

Latest Chrome extension security standard

No eval()

No dynamic code execution

Strict CSP

Content Security Policy enforced

Web Store Review

Chrome Web Store security review (pending)

​
Security Best Practices

For Users:
  • Clear stored data regularly to minimize PII exposure
  • Review blocking rules to prevent unauthorized access
  • Keep extension updated to latest version
  • Disable analytics if handling sensitive data
For Developers:
  • Follow secure coding practices
  • Review security policy before contributing
  • Report vulnerabilities privately
  • Sign commits when possible

​
Contact

For security concerns:

Email

security@contextfort.ai

GitHub

@ContextFort-AI
For general questions, see the README.