Justinaquino: Create SOP: third-party software security review workflow + first due-diligence result (offline-browser-translate)

2026-08-09T06:23:57Z

Create SOP: third-party software security review workflow + first due-diligence result (offline-browser-translate)

New page

= SOP: Third-Party Software Security Review (Due Diligence) =

'''Purpose:''' No third-party code — GitHub repos, browser extensions, open-source tools — is installed or run on Comfac machines without a security review first. The review emphasis is '''data leakage / exfiltration risk''', then permissions vs. purpose, obfuscation, supply chain, and repository history.

The full workflow, criteria, and triage script live in the IT-knowledge repo: <code>IT-knowledge/skills/repo-security-review/</code> (git.gi7b.org). Finished review reports are filed in <code>IT-knowledge/skills/repo-security-review/reports/</code>.

== Workflow ==

# '''Acquire and pin.''' Clone full history into a scratch area (never a synced project folder). Record the exact commit (<code>git rev-parse HEAD</code>) — the verdict covers that commit only.
# '''Automated triage.''' Run the pattern pack:
#: <syntaxhighlight lang="bash">bash IT-knowledge/skills/repo-security-review/scripts/triage-scan.sh <git-url> agent260222/repo-scans</syntaxhighlight>
#: It scans for hardcoded endpoints, network calls, telemetry keywords, obfuscation/dynamic exec, remote code loading, dangerous extension APIs, data-at-rest, injection sinks, IPC/message surfaces, committed secrets, install/CI hooks, binaries, and contributor history. '''A clean triage is not a verdict''' — it finds where to look.
# '''Manual review.''' Read every triage hit in context; read the manifest/permissions and trace the data flow: what user data is read, where does every network call send, what persists. Every egress destination must be user-configured or justified by the feature — anything else is a finding.
# '''Verdict and report.''' File the report under <code>reports/YYMMDD-<repo>.md</code> with target + commit, verdict, data-flow map, findings table (with file:line evidence), and caveats.
# '''Re-review on change.''' A verdict expires on update, permission/manifest change, ownership change, or a dependency adding a binary blob. Diff from the reviewed commit and re-triage the delta.

== Criteria Checklist ==

{| class="wikitable"
! # !! Question !! Fail closed when
|-
| 1 || Can you enumerate every network destination? || Hidden/encoded endpoints
|-
| 2 || Does every egress match the stated purpose? || Data leaves to a party the user didn't configure
|-
| 3 || Is the permission set minimal for the purpose? || Broad grants (<all_urls>, filesystem, exec) without justification
|-
| 4 || Is all executed code readable? || Obfuscation, blobs without source, remote code loading
|-
| 5 || Does anything run before you consent? || postinstall hooks, curl|sh installs, unpinned self-update
|-
| 6 || What user data is read and where is it stored? || Silent persistence of content/credentials
|-
| 7 || Are IPC/message boundaries validated? || Privileged handlers trusting unverified senders
|-
| 8 || Is the supply chain pinned? || Unpinned deps, unsigned release binaries
|-
| 9 || Does history/metadata support trust? || New owner + permission bump, throwaway account
|-
| 10 || Would you notice if an update turned evil? || Auto-update with no hash check
|}

== Verdicts ==

* '''CLEAN''' — install OK.
* '''CLEAN WITH CONDITIONS''' — install OK if the listed configuration conditions are met.
* '''SUSPICIOUS''' — do not install; the report lists what would change the verdict.
* '''MALICIOUS''' — do not install; consider reporting upstream.

Severity: '''Critical''' (exfiltration, RCE, credential theft) · '''High''' (exfiltration capability gated only by config/obscurity, obfuscated payload) · '''Medium''' (over-broad permissions, cleartext transport of user content, missing origin checks) · '''Low''' (privacy footguns, hygiene) · '''Info'''.

== Review Log ==

{| class="wikitable"
! Date !! Target !! Commit !! Verdict !! Report
|-
| 2026-08-09 || [https://github.com/Eldoprano/offline-browser-translate offline-browser-translate] (Firefox extension, local-LLM page translation) || d2b0907 || '''CLEAN WITH CONDITIONS''' || IT-knowledge: <code>skills/repo-security-review/reports/260809-offline-browser-translate.md</code>
|}

=== 2026-08-09 — offline-browser-translate (Local LLM Translator) ===

Static review of all source (60 commits, full history) at commit <code>d2b0907</code>. No exfiltration, no telemetry, no obfuscation, no remote code loading, no dependencies or install hooks. The extension's "your data never leaves your machine" claim is accurate '''for the default configuration''':

* All 7 <code>fetch()</code> call sites send page text only to the user-configured LLM server URL (default <code>localhost:11434/1234</code>). Non-localhost URLs require an explicit per-origin browser permission prompt.
* No third-party endpoints anywhere; declared Firefox data-collection permission is "none", consistent with the code.
* Translations are inserted via <code>textContent</code> only (no XSS sink); all <code>innerHTML</code> uses are static template strings.

'''Conditions (configuration risks, not code defects):'''

# Point it only at localhost or a trusted machine — page text goes to whatever server URL is configured.
# Remote (LAN) server URLs are plain HTTP — translated page content is cleartext on the wire.
# Leave the translation cache at its default (<code>off</code>) for sensitive pages; <code>persistent</code> mode stores translated page text in IndexedDB.
# The optional <code><all_urls></code> permission (floating button) runs the content script on every page — broad, but user-initiated, and data still flows only to the configured endpoint.

'''Caveats:''' static review only (no runtime network capture); the AMO store artifact was not diffed against the repo; verdict covers commit d2b0907 only — updates require a delta re-review.

== Related ==

* [[Open Source Software Analysis]] — architecture/contribution analysis of OSS projects (complementary, not a security review)
* [[Procedure: CC-Blast Data Breach Prevention]]
* [[SCA Program Plan 260320]]

[[Category:Security]]
[[Category:SOP]]
[[Category:IT Operations]]
[[Category:Open Source]]

SOP: Third-Party Software Security Review - Revision history

Justinaquino: Create SOP: third-party software security review workflow + first due-diligence result (offline-browser-translate)