Only the latest version published to the Chrome Web Store receives security updates.

Please do not open public issues for security vulnerabilities.

Instead, report vulnerabilities through GitHub Security Advisories.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if you have one)

• Acknowledge your report within 48 hours
• Triage within 7 days
• Fix critical issues within 30 days

Raft is designed with a local-first, privacy-respecting architecture:

• Client-side encryption — Cloud sync data is encrypted with AES-256-GCM before leaving your device. Keys are derived using PBKDF2 with 100,000 iterations.
• No analytics or telemetry — Raft collects no usage data.
• Local by default — All data stays in local browser storage unless you explicitly enable Cloud Sync. This is verified by automated tests.
• Tight CSP — Content Security Policy uses explicit allowlists with object-src 'none'.
• Minimal permissions — See raftapp.io/permissions for a full breakdown of each permission and why it's needed.

For more detail, see our Trust page.

• Raft extension code (this repository)
• Encryption and key derivation implementation
• Data handling and storage
• OAuth flow and token management
• Cloud sync protocol

• Chrome browser vulnerabilities (report to Chromium)
• Google Drive or Google OAuth service issues (report to Google)
• Social engineering attacks
• Attacks requiring physical access to the device