Security: bindertools/binder

Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Security fixes are applied to the latest release only. We do not backport fixes to older versions.

VersionSupported
Latest release✅ Yes
Older releases❌ No

Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, report it privately using one of these methods:

Option 1 — GitHub Private Security Advisory (Preferred)

Use GitHub's built-in private reporting:

  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form

This creates a private discussion between you and the maintainers, with the option to request a CVE.

Option 2 — Direct Contact

If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.

What to Include

A useful vulnerability report includes:

  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated

Response Timeline

StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter

We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.

Scope

The following are in scope for this policy:

The following are out of scope:

  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine

Security Considerations for Plugin Authors

Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:

  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege

Plugins that violate these principles may be removed from the in-app store.

Disclosure Policy

We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: bindertools/binder
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
Security fixes are applied to the latest release only. We do not backport fixes to older versions.
VersionSupported
Latest release✅ Yes
Older releases❌ No
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability, report it privately using one of these methods:
Option 1 — GitHub Private Security Advisory (Preferred)
Use GitHub's built-in private reporting:
  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form
This creates a private discussion between you and the maintainers, with the option to request a CVE.
Option 2 — Direct Contact
If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.
What to Include
A useful vulnerability report includes:
  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated
Response Timeline
StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter
We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.
Scope
The following are in scope for this policy:
The following are out of scope:
  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine
Security Considerations for Plugin Authors
Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:
  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege
Plugins that violate these principles may be removed from the in-app store.
Disclosure Policy
We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: bindertools/binder
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
Security fixes are applied to the latest release only. We do not backport fixes to older versions.
VersionSupported
Latest release✅ Yes
Older releases❌ No
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability, report it privately using one of these methods:
Option 1 — GitHub Private Security Advisory (Preferred)
Use GitHub's built-in private reporting:
  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form
This creates a private discussion between you and the maintainers, with the option to request a CVE.
Option 2 — Direct Contact
If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.
What to Include
A useful vulnerability report includes:
  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated
Response Timeline
StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter
We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.
Scope
The following are in scope for this policy:
The following are out of scope:
  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine
Security Considerations for Plugin Authors
Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:
  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege
Plugins that violate these principles may be removed from the in-app store.
Disclosure Policy
We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: bindertools/binder
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
Security fixes are applied to the latest release only. We do not backport fixes to older versions.
VersionSupported
Latest release✅ Yes
Older releases❌ No
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability, report it privately using one of these methods:
Option 1 — GitHub Private Security Advisory (Preferred)
Use GitHub's built-in private reporting:
  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form
This creates a private discussion between you and the maintainers, with the option to request a CVE.
Option 2 — Direct Contact
If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.
What to Include
A useful vulnerability report includes:
  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated
Response Timeline
StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter
We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.
Scope
The following are in scope for this policy:
The following are out of scope:
  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine
Security Considerations for Plugin Authors
Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:
  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege
Plugins that violate these principles may be removed from the in-app store.
Disclosure Policy
We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: bindertools/binder
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
Security fixes are applied to the latest release only. We do not backport fixes to older versions.
VersionSupported
Latest release✅ Yes
Older releases❌ No
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability, report it privately using one of these methods:
Option 1 — GitHub Private Security Advisory (Preferred)
Use GitHub's built-in private reporting:
  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form
This creates a private discussion between you and the maintainers, with the option to request a CVE.
Option 2 — Direct Contact
If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.
What to Include
A useful vulnerability report includes:
  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated
Response Timeline
StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter
We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.
Scope
The following are in scope for this policy:
The following are out of scope:
  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine
Security Considerations for Plugin Authors
Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:
  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege
Plugins that violate these principles may be removed from the in-app store.
Disclosure Policy
We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: bindertools/binder
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
Security fixes are applied to the latest release only. We do not backport fixes to older versions.
VersionSupported
Latest release✅ Yes
Older releases❌ No
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability, report it privately using one of these methods:
Option 1 — GitHub Private Security Advisory (Preferred)
Use GitHub's built-in private reporting:
  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form
This creates a private discussion between you and the maintainers, with the option to request a CVE.
Option 2 — Direct Contact
If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.
What to Include
A useful vulnerability report includes:
  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated
Response Timeline
StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter
We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.
Scope
The following are in scope for this policy:
The following are out of scope:
  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine
Security Considerations for Plugin Authors
Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:
  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege
Plugins that violate these principles may be removed from the in-app store.
Disclosure Policy
We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: bindertools/binder
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
Security fixes are applied to the latest release only. We do not backport fixes to older versions.
VersionSupported
Latest release✅ Yes
Older releases❌ No
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability, report it privately using one of these methods:
Option 1 — GitHub Private Security Advisory (Preferred)
Use GitHub's built-in private reporting:
  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form
This creates a private discussion between you and the maintainers, with the option to request a CVE.
Option 2 — Direct Contact
If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.
What to Include
A useful vulnerability report includes:
  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated
Response Timeline
StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter
We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.
Scope
The following are in scope for this policy:
The following are out of scope:
  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine
Security Considerations for Plugin Authors
Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:
  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege
Plugins that violate these principles may be removed from the in-app store.
Disclosure Policy
We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: bindertools/binder
Security
Report a vulnerability

SECURITY.md

Security Policy
Supported Versions
Security fixes are applied to the latest release only. We do not backport fixes to older versions.
VersionSupported
Latest release✅ Yes
Older releases❌ No
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability, report it privately using one of these methods:
Option 1 — GitHub Private Security Advisory (Preferred)
Use GitHub's built-in private reporting:
  1. Go to the Security tab of this repository
  2. Click "Report a vulnerability"
  3. Fill out the advisory form
This creates a private discussion between you and the maintainers, with the option to request a CVE.
Option 2 — Direct Contact
If you are unable to use GitHub's advisory system, contact the maintainers directly through GitHub.
What to Include
A useful vulnerability report includes:
  • Type of issue — e.g., code injection, path traversal, privilege escalation, information disclosure
  • Affected component — which file, module, or feature is affected
  • Steps to reproduce — a minimal, reliable reproduction
  • Impact — what an attacker could achieve by exploiting this
  • Suggested fix — optional, but appreciated
Response Timeline
StageTarget
Initial acknowledgmentWithin 48 hours
Severity assessmentWithin 5 business days
Fix or mitigationDepends on severity — critical issues are prioritized
Public disclosureAfter a fix is released, coordinated with the reporter
We aim to keep you informed throughout the process and will credit reporters in the release notes unless you prefer to remain anonymous.
Scope
The following are in scope for this policy:
The following are out of scope:
  • Third-party community plugins (report those to the plugin author)
  • Community-contributed themes
  • Vulnerabilities in Wails, Monaco, xterm.js, or other upstream dependencies (report those to the respective upstream projects)
  • Social engineering attacks
  • Denial-of-service attacks that require physical access to the machine
Security Considerations for Plugin Authors
Binder plugins execute JavaScript in a sandboxed WebView context. Plugin authors should:
  • Not request unnecessary Wails backend bindings
  • Not read or write files outside the user's working directory without explicit permission
  • Not make network requests to unexpected endpoints
  • Follow the principle of least privilege
Plugins that violate these principles may be removed from the in-app store.
Disclosure Policy
We follow coordinated disclosure. We ask that you give us a reasonable amount of time to address the vulnerability before making it public. We will work with you to agree on a disclosure timeline.
 There aren't any published security advisories