We actively maintain security updates for the following versions:

• TrustedTypes policy implementation for safe HTML handling
• Strict validation of all user inputs and external data
• Sanitization utilities for XSS prevention

• YouTube video ID validation (11-character alphanumeric)
• YouTube channel ID validation (UC prefix + 22 characters)
• URL validation for YouTube domains only
• Number range validation

• API request rate limiting (10 requests per minute per endpoint)
• Prevents abuse and DoS attacks
• Automatic cleanup of old request records

• No sensitive data storage
• Local storage only for user preferences
• No external data transmission except to YouTube/approved APIs

• Safe innerHTML usage with TrustedTypes
• Attribute validation and sanitization
• Prevention of prototype pollution

• HTTPS-only external requests
• Request timeouts (10 seconds default)
• Response validation
• CORS-aware fetch operations

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

• Preferred: Create a Security Advisory (private)
• Alternative: Email the maintainer (check GitHub profile for contact)
• Public (non-sensitive): Open a GitHub Issue

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if available)
• Your contact information for follow-up

• Initial response: Within 48 hours
• Status update: Within 7 days
• Fix timeline: Based on severity
  • Critical: 24-72 hours
  • High: 1-2 weeks
  • Medium: 2-4 weeks
  • Low: Next release cycle

• We follow responsible disclosure practices
• Coordinated disclosure with reporter
• Public disclosure after fix is released
• Credit to reporter (if desired)

1. Input Validation

   • All user inputs are validated
   • Video IDs match regex pattern
   • URLs are from YouTube domains only
   • Numbers are within safe ranges

2. XSS Prevention

   • Use textContent for plain text
   • Use YouTubeSecurityUtils.setInnerHTMLSafe() for HTML
   • Never use innerHTML with unsanitized data
   • Validate all attributes before setAttribute

3. API Security

   • Rate limiting implemented
   • Request timeouts set
   • Response validation performed
   • HTTPS URLs only

4. Error Handling

   • No sensitive data in error messages
   • Proper try-catch blocks
   • User-friendly error messages
   • Logging limited to console.warn/error

5. Code Quality

   • Biome passes with no security warnings
   • CodeQL analysis passes
   • No eval() or Function() constructor
   • No document.write()

• CodeQL: Runs on every push and PR
• Biome: Security rules enabled
• Dependency scanning: GitHub Dependabot (if enabled)

• XSS testing with malicious payloads
• Input validation testing
• Rate limiting verification
• Error handling validation

• Runs in user's browser context
• Relies on Tampermonkey/Greasemonkey security
• Cannot prevent all client-side attacks
• User must trust the script source

• Return YouTube Dislike API (external)
• YouTube InnerTube API (official but undocumented)
• Dependency on external service availability

• TrustedTypes not available in all browsers
• Falls back to less secure methods when unavailable

• Last full audit: December 16, 2025
• Next scheduled audit: Quarterly (Q1 2026: January 1, 2026)
• Automated scanning: Continuous (GitHub Actions)
• Audit workflow: .github/workflows/security-audit.yml

We minimize dependencies to reduce attack surface:

• No runtime dependencies
• Build-time dependencies regularly updated
• Automated dependency updates: Dependabot configured (.github/dependabot.yml)
• Weekly dependency updates: Every Monday at 09:00 UTC
• Automated security updates: Enabled for all vulnerability levels

1. Detection: Via report or automated scanning
2. Assessment: Severity rating (Critical/High/Medium/Low)
3. Containment: Disable affected features if needed
4. Fix: Develop and test patch
5. Deployment: Release patched version
6. Communication: Notify users and reporter
7. Post-mortem: Document lessons learned

• Security issues: Use GitHub Security Advisories
• General questions: Open a GitHub Discussion

• ⚙️ .github/dependabot.yml - Automated dependency update configuration
• 🤖 .github/workflows/security-audit.yml - Automated security audit workflow

Last updated: December 16, 2025
Version: 2.0