Skip to content

SUBMISSION.md

Latest commit

 

History

History
169 lines (118 loc) · 5.92 KB

SUBMISSION.md

File metadata and controls

169 lines (118 loc) · 5.92 KB
Raw

Chrome Web Store submission

Every dashboard field, in the order the form asks for it, with the exact value to paste. STORE.md holds the same copy in a readable form; this is the checklist version.

Two steps here can only be done by you, because they need an account and a card: registering as a developer, and the upload itself. Everything else is prepared.

Before you start

  • Developer account. https://chrome.google.com/webstore/devconsole — one-off 5 USD registration fee, paid once per Google account.

  • Read PUBLISHING.md. Four things are still unverified, and the first one is that no real leak has ever been observed in the wild. That is a product risk, not paperwork.

  • Build the artifact:

    node tools/build.js

157 checks must pass. It produces `wiretype-v0.1.0.zip`. Upload the zip,
not the `dist/` folder.

Package

Upload: wiretype-v0.1.0.zip

The build already verifies these, but confirm before uploading:

  • dist/sensor.js contains DEBUG = false
  • dist/trackers.js has no localhost entry
  • dist/manifest.json version is 0.1.0 and matches the git tag

Store listing

Name

Wiretype

Summary (132 characters max — this is 118)

Warns you when third-party trackers read what you type into forms — before you ever press Submit.

Category: Privacy & Security

Language: English

Description: paste the Detailed description section of STORE.md verbatim.

Do not edit it to sound stronger. It deliberately never says the extension blocks, prevents, or protects — it detects and warns, and by the time it warns the data has gone. tools/smoke-summary.js enforces the same rule on the product's own wording, and a listing that overclaims is both false and grounds for removal.

Graphic assets

  • Icon, 128×128. extension/icons/icon128.png — already generated.

  • Screenshots, 1280×800. At least one, up to five. Capture these four:

    1. fixtures/ui.html      — red verdict, panel open, fields outlined
2. fixtures/phase-a.html — amber tier, nothing read yet
3. fixtures/formdata.html — three fields harvested in one call
4. fixtures/tamper.html  — a bypass caught and reported

**Use the fixtures, not a real website.** A real screenshot names and
accuses a real company in a public store listing.

  • Small promo tile, 440×280. Optional, but listings without one are ranked lower.

Privacy practices

This is the section that gets a listing rejected. Answer precisely.

Single purpose

Wiretype detects third-party scripts reading the contents of form fields on the
page you are viewing, and warns you which field is affected before you type into
it.

Permission justifications — one per permission, from STORE.md:

Permission Justification
host_permissions: <all_urls> Form-field harvesting can happen on any site, so the extension cannot know in advance which pages need watching. It runs the same local check everywhere and sends nothing anywhere.
storage Reserved for user preferences such as per-site muting. No browsing history and no form data is written to it.
sidePanel Renders the findings panel beside the page. Displays locally held data and makes no network requests.

Data usage — declare the following

  • Not collecting personally identifiable information
  • Not collecting health information
  • Not collecting financial or payment information
  • Not collecting authentication information
  • Not collecting personal communications
  • Not collecting location
  • Not collecting web history
  • Not collecting user activity
  • Not collecting website content

All nine are "no". The extension makes no network requests of any kind, has no server and no account, and persists nothing. tools/check-invariant.js proves the mechanical part of this statically and the build refuses to package if it fails.

Certifications — all three are true and can be checked honestly:

  • I do not sell or transfer user data to third parties, outside of the approved use cases
  • I do not use or transfer user data for purposes unrelated to my item's single purpose
  • I do not use or transfer user data to determine creditworthiness or for lending purposes

Privacy policy URL

https://github.com/flyhighbarney/wiretype/blob/main/PRIVACY.md

Expect review scrutiny on two points

Answer from STORE.md rather than improvising.

<all_urls> on a form-reading extension. A content script on every site that touches form APIs is structurally the same shape as an exfiltration extension. The defence is that harvesting can happen anywhere so the extension cannot pre-select pages, combined with the fact that it makes no network requests at all — which is verifiable from the source in minutes.

No remote code. There is none: no CDN scripts, no remote fonts, no icon fonts, no eval, no new Function. Worth stating plainly, because it is unusual and it is the single easiest thing for a reviewer to confirm.

Reviews for a new developer account on a privacy tool with broad host permissions commonly take longer than the advertised few days. A rejection asking for permission justification is normal and is answered, not appealed.

After it is approved

  • Tag the release and attach the exact zip that was uploaded, so anyone can diff the store artifact against the source.
  • Add the store URL to README.md and CHANGELOG.md.
  • Move 0.1.0 in CHANGELOG.md from unreleased to the release date.
  • Watch for reports of broken forms above everything else. The FormData Proxy replaces a global constructor on every site and is the most likely cause. It can be removed on its own — the value-getter hook still covers direct reads without it.