docs(release): Dokumentation ins Englische übersetzen und v1.11.1 Docs
- README, CHANGELOG, DISCLAIMER, SECURITY auf Englisch übersetzen - Projekt-Docs (architecture, patterns, widget-schema, style-guide) übersetzen - CODEOWNERS für Master-Branch-Schutz hinzufügen - release.yml auf Englisch übersetzen - STYLE_GUIDE von src/css/ nach docs/ verschieben
This commit is contained in:
+76
-60
@@ -1,76 +1,92 @@
|
||||
# Sicherheitsrichtlinie — Hellion NewTab
|
||||
# Security Policy — Hellion NewTab
|
||||
|
||||
## Unterstützte Versionen
|
||||
## Supported Versions
|
||||
|
||||
| Version | Status |
|
||||
| --- | --- |
|
||||
| 1.2.x | Aktiv unterstützt |
|
||||
| < 1.2.0 | Nicht unterstützt |
|
||||
|---|---|
|
||||
| 1.9.x | Actively supported |
|
||||
| < 1.9.0 | Not supported |
|
||||
|
||||
## Sicherheitslücke melden
|
||||
## Reporting a Vulnerability
|
||||
|
||||
Wenn du eine Sicherheitslücke in Hellion NewTab findest, melde sie bitte **nicht** über ein öffentliches GitHub Issue.
|
||||
If you find a security vulnerability in Hellion NewTab, please **do not** open a public GitHub issue.
|
||||
|
||||
### Kontakt
|
||||
### Contact
|
||||
|
||||
**E-Mail:** [kontakt@hellion-media.de](mailto:kontakt@hellion-media.de?subject=Hellion%20NewTab%20%E2%80%93%20Security%20Report)
|
||||
**Email:** [kontakt@hellion-media.de](mailto:kontakt@hellion-media.de?subject=Hellion%20NewTab%20%E2%80%93%20Security%20Report)
|
||||
|
||||
Bitte folgende Informationen angeben:
|
||||
Please include the following information:
|
||||
|
||||
- Beschreibung der Schwachstelle
|
||||
- Schritte zur Reproduktion
|
||||
- Betroffene Version(en)
|
||||
- Mögliche Auswirkungen (Datenverlust, XSS, etc.)
|
||||
- Description of the vulnerability
|
||||
- Steps to reproduce
|
||||
- Affected version(s)
|
||||
- Potential impact (data loss, XSS, etc.)
|
||||
|
||||
### Reaktionszeit
|
||||
### Response Times
|
||||
|
||||
- **Bestätigung:** Innerhalb von 48 Stunden
|
||||
- **Ersteinschätzung:** Innerhalb von 7 Tagen
|
||||
- **Fix:** Abhängig von Schweregrad, Ziel innerhalb von 14 Tagen
|
||||
- **Acknowledgement:** Within 48 hours
|
||||
- **Initial assessment:** Within 7 days
|
||||
- **Fix:** Depends on severity, target within 14 days
|
||||
|
||||
### Schweregrad-Einstufung
|
||||
### Severity Levels
|
||||
|
||||
| Stufe | Beschreibung | Beispiel |
|
||||
| --- | --- | --- |
|
||||
| Kritisch | Datenverlust oder Remote Code Execution | Storage-Manipulation durch Dritte |
|
||||
| Hoch | XSS oder ungewollte Datenübertragung | Script-Injection via Bookmark-Import |
|
||||
| Mittel | Umgehung von UI-Schutzmechanismen | Blur-Bypass, Settings-Manipulation |
|
||||
| Niedrig | Kosmetisch oder theoretisch | Edge-Cases ohne praktische Auswirkung |
|
||||
|
||||
## Sicherheitsarchitektur
|
||||
|
||||
### Datenverarbeitung
|
||||
|
||||
- **Keine externe Datenübertragung** — Alle Daten bleiben in `chrome.storage.local`
|
||||
- **Kein Server-Kontakt** — Außer Google Favicons API für Bookmark-Icons
|
||||
- **Keine Cookies, Sessions oder Tokens**
|
||||
- **Kein Netzwerkzugriff** außer Favicon-Abruf
|
||||
|
||||
### Eingabe-Validierung
|
||||
|
||||
- URL-Validierung bei Bookmark-Erstellung (`new URL()`)
|
||||
- JSON-Import: Board- und Bookmark-Struktur wird validiert
|
||||
- HTML-Sanitierung via `escHtml()` und `createElement` (kein `innerHTML` für User-Daten)
|
||||
- Storage-Quota-Prüfung mit Warnung bei 8 MB+
|
||||
|
||||
### Permissions
|
||||
|
||||
Diese Extension benötigt nur zwei Browser-Permissions:
|
||||
|
||||
| Permission | Grund |
|
||||
| --- | --- |
|
||||
| `storage` | Boards, Settings und Sticky Note lokal speichern |
|
||||
| `bookmarks` | Browser-Lesezeichen für HTML-Import lesen |
|
||||
|
||||
Keine Permissions für: Tabs, History, Web Requests, Downloads, Clipboard oder Host-Zugriff.
|
||||
|
||||
### CI/CD-Sicherheit
|
||||
|
||||
- **CodeQL** — Automatische statische Analyse bei Push und PR
|
||||
- **Dependency Review** — Prüft auf bekannte Schwachstellen in PRs
|
||||
- **Wöchentlicher Scan** — Automatischer CodeQL-Lauf jeden Montag
|
||||
- **SHA256-Checksummen** — Alle Release-Artefakte werden signiert
|
||||
| Level | Description | Example |
|
||||
|---|---|---|
|
||||
| Critical | Data loss or remote code execution | Storage manipulation by third parties |
|
||||
| High | XSS or unintended data transmission | Script injection via bookmark import |
|
||||
| Medium | UI protection bypass | Blur bypass, settings manipulation |
|
||||
| Low | Cosmetic or theoretical | Edge cases without practical impact |
|
||||
|
||||
---
|
||||
|
||||
**Hellion Dashboard** — [Hellion Online Media - Florian Wathling](https://hellion-media.de) — JonKazama-Hellion
|
||||
## Security Architecture
|
||||
|
||||
### Data Handling
|
||||
|
||||
- **No external data transmission** — all data stays in `chrome.storage.local`
|
||||
- **No server contact** — except Google Favicons API for bookmark icons
|
||||
- **No cookies, sessions or tokens**
|
||||
- **No network access** beyond favicon fetching
|
||||
|
||||
### Input Validation
|
||||
|
||||
- URL validation on bookmark creation (`new URL()`)
|
||||
- JSON import validates board and bookmark structure before applying
|
||||
- HTML sanitization via `escHtml()` and `createElement` — no `innerHTML` for user data
|
||||
- Storage quota check with warning at 8 MB+
|
||||
|
||||
### Permissions
|
||||
|
||||
This extension requests the following browser permissions:
|
||||
|
||||
| Permission | Browsers | Reason |
|
||||
|---|---|---|
|
||||
| `storage` | All | Store boards, settings and widget states locally |
|
||||
| `bookmarks` | All | Read browser bookmarks for direct import |
|
||||
| `tabs` | Opera / Opera GX only | Required for the Speed Dial workaround — `background.js` monitors tab URLs and redirects via `chrome.tabs.update` |
|
||||
|
||||
No permissions requested for: history, web requests, downloads, clipboard or host access.
|
||||
|
||||
### CI/CD Security
|
||||
|
||||
- **CodeQL** — Automatic static analysis on every push and PR
|
||||
- **Dependency Review** — Checks for known vulnerabilities in PRs
|
||||
- **Weekly scan** — Automated CodeQL run every Monday at 06:00 UTC
|
||||
- **SHA256 checksums** — All release artifacts are checksummed
|
||||
|
||||
---
|
||||
|
||||
## Legal
|
||||
|
||||
Hellion NewTab is developed and maintained by **Florian Wathling / Hellion Online Media**,
|
||||
based in Bad Harzburg, Germany.
|
||||
|
||||
All security matters are handled in accordance with **German and EU law**, including
|
||||
the General Data Protection Regulation (GDPR / DSGVO). Users in the European Union
|
||||
are covered by the same legal framework.
|
||||
|
||||
For legal inquiries: [hellion-media.de/impressum](https://hellion-media.de/impressum)
|
||||
|
||||
---
|
||||
|
||||
**Hellion Dashboard** — [Hellion Online Media — Florian Wathling](https://hellion-media.de) — JonKazama-Hellion
|
||||
|
||||
Reference in New Issue
Block a user