Security fixes target the latest published version of Starcat Chrome Plugin.
Starcat Chrome Plugin is a browser extension that talks to the Starcat app through a local loopback HTTP API:
http://127.0.0.1:{port}/plugin/v1
The extension must not:
- Expose the Starcat Local API Key in logs, page DOM, URLs, or remote requests.
- Send Starcat private notes to any remote service.
- Call GitHub, OpenSSF, AI providers, or Starcat backend services directly.
- Broaden host permissions beyond the minimum needed for GitHub repository pages,
supported Google Search result pages, and the local Starcat service on
127.0.0.1.
Please report security issues through GitHub Security Advisories before opening a public issue.
Include:
- Affected version or commit.
- Steps to reproduce.
- Expected and actual behavior.
- Any relevant browser, macOS, and Starcat app versions.
The Starcat Local API Key authorizes only local loopback API access. Treat it as a secret:
- Do not publish it in screenshots, bug reports, or logs.
- Rotate it from the Starcat app if it may have leaked.
- Do not reuse GitHub tokens, AI keys, or Starcat backend API keys as the Starcat Local API Key.