Security
The plugin runs inside your vault, so its security posture is deliberately strict. This page lists every measure in place and links each one’s live results; the repository’s SECURITY.md is the canonical copy and includes how to report a vulnerability privately.
Design constraints
- Zero third-party runtime dependencies. The shipped bundle contains only the plugin’s own code plus @tsvsheet/tsvsheet; the compute engine is the tsvsheet Go implementation compiled to WebAssembly, running in-process with no I/O of its own.
- No network access. The plugin makes no requests; the engine and all assets load from the plugin’s own directory.
- No HTML from data. Grid values — including formula results and error strings — render via
textContentonly, so vault content can never inject markup or script. - Your files are never rewritten with computed output. The
.tsvtview persists only the engine’s canonical source serialization — formulas, comments, and the trailing newline survive every edit exactly.
Automated scanning (live results)
| Measure | Cadence | Live results |
|---|---|---|
| CodeQL static analysis — GitHub-managed default setup, enforced organization-wide over the TypeScript sources and the Actions workflows themselves | every push + weekly | code scanning alerts |
npm audit dependency vulnerability scan, all severities, dev dependencies included | every push/PR + weekly | workflow runs |
| OSSF Scorecard supply-chain posture rating | every push + weekly | public scorecard · workflow runs |
| Dependabot vulnerability alerts (all ecosystems) and weekly GitHub Actions version updates — npm currency is held by the audit gate above, since version updates cannot retrieve a path dependency | continuous + weekly | dependency updates |
| Secret scanning with push protection | continuous | enforced by GitHub on every push |
Repository constraints
- Every commit is cryptographically signed; the organization enforces verified signatures on push.
- The repository’s own workflows grant least-privilege permissions and pin third-party actions by commit SHA.
- The plugin gate — typecheck, lint, tests, production build — runs on every push and pull request (verify), and the repository’s badges surface each workflow’s current state on the project README.
- Vulnerabilities are reported through GitHub private vulnerability reporting, never public issues.