Security Architecture
Engineering standards, Manifest V3 compliance, and local threat modeling.
1. Strict Manifest V3 Enforcement
Tabvora is compiled fully within Chrome's Manifest V3 platform. In strict accordance with Web Store policies:
- No remote scripts, hosted JS files, or dynamically evaluated code (e.g.,
eval()) are permitted or used. - Background tasks run exclusively inside ephemeral, non-persistent Service Workers.
- Strict Content Security Policies (CSP) block all remote script loading and inline code execution. Tabvora operates without any backend server — the only outbound requests are standard browser navigation, checking whether a saved shortcut's URL is reachable, and page interactions used by the optional Draft Recovery and Website Usage Statistics features, none of which send data to a Tabvora-owned server.
2. Open Source Verifiability
The entire source code of Tabvora is public and auditable on GitHub. Security researchers and users can verify that the published Chrome Web Store zip file matches the open-source repository commit history line-for-line.
3. Vulnerability Reporting
If you discover a potential security concern within Tabvora, please report it privately through our GitHub Security Advisory channel rather than public issue trackers.