player-switch-for-autodarts

Only the latest release gets fixes, and the browser installs each new version by itself. The saved accounts keep working across updates: an update migrates their stored format, and going back to an older version never wipes them; a breaking change is a major version whose notes say what to do: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/docs/development.md#the-saved-accounts-keep-their-format

GitHub Issues, with forms for bugs and feature requests: https://github.com/Dennis-Otto/player-switch-for-autodarts/issues

No vulnerability was reported or resolved in the last 12 months; the repository has no security advisory. SECURITY.md promises credit in the advisory and the release notes to every reporter who doesn't prefer anonymity: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/SECURITY.md#what-happens-next

SECURITY.md documents the process: private reporting, an acknowledgement within 7 days, a first assessment within 14 days, a fix within 90 days at the latest and the disclosure in an advisory: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/SECURITY.md#what-happens-next

CONTRIBUTING.md names the coding standards that contributions follow: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/CONTRIBUTING.md#coding-standards

scripts/check.sh and the Lint workflow check the coding standards on every pull request, which merges only when they pass: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/scripts/check.sh

The project produces no native binaries: the build is the TypeScript compiler, which writes the JavaScript that the browser runs.

There is no native build that could strip debugging information: tsc writes readable JavaScript that keeps the structure and the names of the source.

There is no build system that builds subdirectories: one run of tsc --project tsconfig.build.json compiles all of src/.

A browser extension installs from the Chrome Web Store, once its listing is live, or with Load unpacked under chrome://extensions, as the README describes, and is removed under chrome://extensions, the common ways of the browser: https://github.com/Dennis-Otto/player-switch-for-autodarts#install

There is no installation step that writes to a chosen location: the browser decides where an extension goes.

CONTRIBUTING.md shows how to run every check with bash scripts/check.sh, and the dev container in .devcontainer/ has every tool set up, for VS Code and GitHub Codespaces: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/CONTRIBUTING.md#checks

package.json lists the direct dependencies, and package-lock.json pins each with its hash: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/package.json

Renovate updates the dependencies, an update that fixes a vulnerability at once, and OSV-Scanner checks every lock file in the pull requests that change one, after every change of main and every week: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/.github/workflows/osv-scanner.yml

Every dependency comes from its package manager, pinned in a lock file, every action by its commit hash and every image by its digest, and Renovate updates them: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/GOVERNANCE.md#automation

The extension uses Manifest V3 and the current chrome.* APIs, typed by @types/chrome, and no deprecated one; the workflow Upstream runs the end-to-end tests every morning against the next Chrome, Beta, and checks what the extension needs of Autodarts, and addons-linter flags APIs that Firefox deprecates: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/docs/development.md#what-autodarts-and-the-next-chrome-change

The CI runs scripts/check.sh with the whole test suite on every pull request and after every change of main, and reports its success or failure as a required check: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/scripts/check.sh

Every bug fixed since the repository started on 2026-10-15 brought its regression test in the same pull request, 8 of 8, as CONTRIBUTING.md requires: for example #31, #37, #39, #51, #57, #58 and #62: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/CONTRIBUTING.md#tests

npm test, with the coverage of Node.js (FLOSS), fails below 100 % of the lines, branches and functions of src/ outside the pages and of scripts/store-status.ts and scripts/upstream-contract.ts: about 4,550 of 5,580 lines of code of src/ and those scripts. The pages, about 1,025 lines of code, run in the end-to-end tests and the accessibility check without a measurement, so even counted as never run the suite covers about 82 %: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/package.json

CONTRIBUTING.md has the written policy: changes need tests in the automated test suite, and the checks of scripts/check.sh pass: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/CONTRIBUTING.md#requirements-for-changes

CONTRIBUTING.md requires tests with every change, and the checklist of the pull request template asks for tests that cover it: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/.github/pull_request_template.md

The TypeScript compiler runs in strict mode with exactOptionalPropertyTypes, noUncheckedIndexedAccess, noImplicitReturns, noUnusedLocals and noUnusedParameters, a warning of Biome fails the checks, and ShellCheck, actionlint, zizmor and markdownlint fail on every finding: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/tsconfig.json

The extension applies least privilege (four permissions and two hosts), fail-safe defaults (no password kept unless asked, the venue mode off until a person turns it on, a secret that doesn't open makes the account sign in again rather than fail open), complete mediation (the service worker checks the sender of every request and every PIN) and separation of privilege (the content script can't read the storage), as docs/security.md shows; the assurance case of SECURITY.md applies all eight principles of Saltzer and Schroeder to the repository and its releases: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/docs/security.md

Nothing depends on an algorithm or mode with known serious weaknesses: no SHA-1, no MD5, no CBC; the key is a non-extractable CryptoKey, and the PIN hashes are compared in constant time.

No credential is in the code: the sealed refresh tokens and passwords are records of their own in the storage of the extension, the key a non-extractable CryptoKey in a database of its own (IndexedDB), and none reaches a log. Users replace them without a new build: a new sign-in, Remember password or forgetting it, Remove account, and Forget all accounts, which also replaces the key.

Every connection uses HTTPS: the host permissions are https://play.autodarts.com and https://api.autodarts.com only, and the content security policy of the extension's pages allows connections to https://api.autodarts.com alone and images only over HTTPS or as data URLs: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/extension/manifest.json

TLS comes from the browser, which supports TLS 1.2 and 1.3 and refuses older versions.

Every request goes through fetch of the browser, which verifies the TLS certificate, for subresources too; an extension can't turn that off.

The browser verifies the certificate in the TLS handshake, before fetch sends any header or body with a refresh token or a password.

Every release is immutable, its tag is signed without a key by the release workflow with gitsign, and GitHub signs an attestation that ties the tag to its commit and its files, whose build provenance is signed with Sigstore; gh release verify checks the attestation with the public keys of GitHub, as SECURITY.md shows. The Chrome Web Store signs every package that it delivers: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/SECURITY.md#verify-a-release

The release workflow signs every release tag without a key with gitsign, and builds no release on a tag that it didn't sign: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/SECURITY.md#how-the-project-keeps-itself-secure

Every input from outside is checked before use: readRequest in src/messages.ts takes each message of a page or the content script only in a known shape, and the service worker only from a sender it trusts, by id and address; an answer of the Autodarts sign-in service is read as a session or an AuthError; stored data of any shape is read without failing, which property-based tests check; a PIN must be 4 to 8 digits: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/src/messages.ts

A content security policy that runs only the extension's own scripts and connects to api.autodarts.com alone, a storage that the service worker limits to the extension's own contexts, a switcher in a frame of the extension's origin inside a closed shadow root, web-accessible only for play.autodarts.com, chrome.scripting that runs only the packaged content.js, a minimum Chrome version, and scripts/check-manifest.mjs, which refuses new permissions, externally_connectable, optional permissions and scripts in the world of the page: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/docs/security.md#threats-and-countermeasures

SECURITY.md has the assurance case of the repository and its releases: the threat model, the trust boundaries, the secure design principles and how the OWASP Top 10 CI/CD security risks are countered, with CodeQL for the CWE Top 25. docs/security.md completes it for the extension: what it keeps, its trust boundaries, the threats with their countermeasures and the risks that remain: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/SECURITY.md#assurance-case

CodeQL runs its security-extended queries, which look for the weaknesses of the CWE Top 25 and zizmor audits the workflows for their security: https://github.com/Dennis-Otto/player-switch-for-autodarts/blob/main/.github/workflows/codeql.yml

The extension is written in TypeScript, a memory-safe language.