Security Architecture
Engineering standards, Manifest V3 compliance, and local threat modeling.
1. Strict Manifest V3 Enforcement
Tabvora is compiled fully within Chrome's Manifest V3 platform. In strict accordance with Web Store policies:
- No remote scripts, hosted JS files, or dynamically evaluated code (e.g.,
eval()) are permitted or used. - Background tasks run exclusively inside ephemeral, non-persistent Service Workers.
- Strict Content Security Policies (CSP) block all remote script loading and inline code execution. Tabvora operates completely without any backend server — zero background or automated network requests are transmitted from any extension feature. Outbound network traffic occurs exclusively during standard browser navigation when you intentionally click a shortcut link or perform a web search through your default search engine.
2. Open Source Verifiability
The entire source code of Tabvora is public and auditable on GitHub. Security researchers and users can verify that the published Chrome Web Store zip file matches the open-source repository commit history line-for-line.
3. Vulnerability Reporting
If you discover a potential security concern within Tabvora, please report it privately through our GitHub Security Advisory channel rather than public issue trackers.