Report privately through GitHub's private vulnerability reporting, or by email to th@wdogsystems.com. Please do not open a public issue for a security problem.

Include what an attacker can do, the page structure or extension settings needed to trigger it, and the Chrome version you saw it on. A page that reproduces the problem is the most useful thing you can send.

This is a personal project maintained in spare time. I will acknowledge a report within a week and give you an honest assessment of whether and when I expect to fix it. There is no bounty and no service level; if a report sits longer than that, a nudge is welcome.

Only the current master branch is supported. There are no maintenance branches and no backports — fixes land on master, and users update by pulling and reloading the unpacked extension.

Screenie holds two capabilities that are worth attention, and both are places where a bug would matter more than the size of the codebase suggests.

The debugger permission. Screenie attaches Chrome's debugger to the tab you capture, which gives it the ability to run script in that page. It uses this to measure the page, scroll it, and inject the annotation markup. Anything that lets a visited page influence what Screenie evaluates in that context is a real vulnerability, not a cosmetic one.

Values interpolated into injected script. The annotation attribute names from Settings are built into CSS selectors and into injected script source. They are validated against ^data-[A-Za-z0-9_-]+$ before use, and annotation text taken from the page is escaped before being written into the annotation section. A way around either check is worth reporting.

Also in scope: anything that causes Screenie to make a network request, since it is supposed to make none; anything that leaves the visited page modified after a capture finishes or fails; and any path that writes a downloaded file outside the configured directory under Downloads.

• The "Screenie started debugging this tab" banner Chrome shows during capture. Chrome requires it and no extension can suppress it.
• The inability to capture chrome:// and chrome-extension:// pages. That is a Chrome restriction.
• Content in a capture that the page itself put there. Screenie records what the page rendered, including anything hostile the page chose to display.
• Reports from automated scanners with no working reproduction against this extension.