Opinionated conventions for building secure, cross-browser Manifest V3 extensions with TypeScript.
# Browser Extension taste of a cross-browser extension developer - Build on Manifest V3 and plan around service workers that can be stopped at any time. Confidence: 0.95 - Use a framework like WXT or Plasmo with TypeScript and Vite to handle builds, reloads and cross-browser manifests. Confidence: 0.80 - Request the fewest permissions possible, and prefer activeTab and optional_permissions over broad host access. Confidence: 0.95 - Never request the all_urls host permission unless the core feature truly needs every site. Confidence: 0.90 - Keep no important state in service worker globals and persist it with chrome.storage instead. Confidence: 0.95 - Use chrome.storage.session for temporary secrets and chrome.storage.local or sync for user settings, with a typed wrapper and defaults. Confidence: 0.85 - Use chrome.alarms for scheduled work instead of setInterval in the background. Confidence: 0.90 - Register all event listeners at the top level of the service worker so they survive restarts. Confidence: 0.90 - Keep content scripts small and inject them programmatically with chrome.scripting when possible. Confidence: 0.85 - Isolate injected UI in a Shadow DOM so page styles and extension styles cannot collide. Confidence: 0.90 - Treat every message from content scripts and web pages as untrusted and validate it with a schema. Confidence: 0.95 - Define message types in one shared module and use typed request and response helpers for runtime messaging. Confidence: 0.85 - Never inject remote code or use eval, and keep a strict Content Security Policy. Confidence: 0.95 - Use declarativeNetRequest for blocking or modifying requests instead of trying to intercept them in code. Confidence: 0.85 - Use the webextension-polyfill or a framework layer so the same code runs on Chrome, Firefox, Edge and Safari. Confidence: 0.80 - Collect as little user data as possible and explain clearly in the store listing what is stored and why. Confidence: 0.90 - Handle install and update events to migrate stored settings between versions. Confidence: 0.85 - Test popup and options pages as normal web UI, and run end-to-end tests with Playwright loading the unpacked extension. Confidence: 0.80 - Automate builds, version bumps and store uploads in CI, with one zip artifact per browser. Confidence: 0.80 - Keep the popup fast by loading heavy data lazily and showing cached state first. Confidence: 0.80 - Write a short permission justification for each permission before submitting to the store. Confidence: 0.85
Reviews Dockerfiles for security, image size, build cache, and runtime reliability: secrets baked into layers, running as root, unpinned base images, curl piped to a shell, ADD misuse, leftover apt and pip caches, cache-busting dependency installs, shell-form CMD, and missing multi-stage builds or health checks, then writes a corrected Dockerfile and .dockerignore. Use when a user shares a Dockerfile and asks "review my Dockerfile", "why is my image so big?", or "is this container secure?".
Reviews bash and POSIX sh scripts before they run in CI, cron or production. Flags missing strict mode, rm -rf on variables that may be empty, curl piped to a shell, eval, unquoted expansions, unchecked cd, parsing ls, chmod 777, hardcoded secrets, predictable /tmp files, ssh eating a read loop, masked exit codes and bashisms under /bin/sh, then returns a fixed script. Includes a stdlib Python linter with --self-test.
Audits foreground/background color pairs for WCAG 2.x contrast (AA and AAA for normal and large text), reports ratios and pass/fail, and notes color-blindness risks. Use when checking UI palettes, design tokens, or asking "is this gray-on-white readable?". Includes a stdlib Python contrast checker with --self-test.
Lints .env and .env.example files for secrets committed by mistake, weak names, duplicate keys, export prefixes, spaces around equals, empty required values, and unsafe interpolation, then suggests a cleaned example file. Use when a user asks "is this .env safe to commit?", "why won't dotenv load?", or "diff my .env.example". Includes a tested stdlib Python linter.
