If you discover a security issue in Avemo Dev, please do not open a public issue. Instead, report it privately:
- Use GitHub's private vulnerability reporting, or
- Email philipp@avemostudio.com with the details.
Please include:
- A description of the issue and its potential impact.
- Steps to reproduce (a minimal example or the page/site where it triggers).
- The extension version and browser/version you observed it on.
You can expect an initial acknowledgement within a few days. Once a fix is ready, a patched version will be released and the report credited (unless you prefer to remain anonymous).
Avemo Dev is a client-side browser extension. It:
- Reads the DOM of the page you're inspecting only to draw overlays and the inspector readout — page content is never transmitted anywhere.
- Stores overlay configuration and panel state locally in
chrome.storage.local. Nothing leaves your device. - Bundles all code and assets (including the Inter font) locally — no remotely-hosted code is fetched or executed, per Manifest V3 requirements.