NoaLingua for Chrome
Add to Chrome — Free Add to Chrome

Trust

Reporting a vulnerability

Report security issues to support@noasolutions.org rather than in public. NoaLingua is a Manifest V3 extension that executes no remotely hosted code, and it treats page content, subtitle text and model output as untrusted input everywhere they are handled.

Reporting

Email support@noasolutions.org with enough detail to reproduce the issue. There is also a security.txt at the standard location.

Expect an acknowledgement within a few working days. This is a one-person project, so there is no bug bounty and no formal response-time commitment. What there is, is somebody who will read it and take it seriously.

No remotely hosted code

Manifest V3 forbids executing code fetched at runtime, and the project holds to that rather than looking for the edge of the rule. Everything that executes ships inside the extension package and is reviewable in the store submission.

This is also why the checkout for paid plans is a page on this website rather than anything inside the extension: a payment script could never run in an extension context, so the extension's only involvement is opening a URL in a new tab.

The one runtime download worth naming is the punctuation model. Those are weights — data, not code — loaded by a runtime that itself ships inside the package.

Everything from outside is untrusted

Page content, subtitle text and anything a language model produces are treated as untrusted input. Model output in particular is rendered as plain text through safe components and never as HTML — a subtitle is attacker-controllable on any site that lets a user upload one.

Messages between the extension's own parts are typed and validated on arrival rather than trusted because of where they claim to come from.

What is stored and what leaves the device · every permission and its limits · how local-first works · terms of use

Scope

  • The NoaLingua Chrome extension.
  • This website, noalingua.com.
  • The licence-check endpoint, which stores a licence key, a status and a plan name.

Payment processing is handled by Paddle as Merchant of Record. Issues in Paddle's own systems should go to Paddle, though we would still like to know.