Lightstreamer Workbench is a developer tool that observes inspected-page runtime data. Security and privacy reports are taken seriously because captured Lightstreamer payloads can contain proprietary or user-sensitive application data.
Canonical policy URL: https://imom39a.github.io/lightstreamer-workbench-extension/security/
Supported versions
Security fixes target the current Chrome Web Store release and the current main branch:
| Version | Status |
|---|---|
2.0.x |
Current public release; supported |
Older releases receive no routine fixes. Upgrade to the latest Chrome Web Store version before reporting a vulnerability unless the issue specifically concerns the upgrade path.
Report a vulnerability
Do not open a public issue with exploit details, production payloads, tokens, cookies, account identifiers, or private URLs.
- Use GitHub private vulnerability reporting.
- If that private flow is unavailable, open a minimal public support issue asking for maintainer security contact. Omit all exploit details and sensitive data.
- Include a concise impact summary, affected version or commit, browser version, reproduction outline, and a sanitized proof of concept only in the private report.
The maintainers triage reports based on exploitability, user impact, captured-data exposure, and extension-store release risk.
Use the private security path for
- Captured Evidence leaving the local browser unexpectedly.
- Tokens, cookies, credentials, private URLs, or page secrets exposed by extension behavior.
- Remote code execution, unsafe dynamic script loading, or dependency supply-chain risks.
- Extension permission expansion beyond the documented debugging need.
- Local Injection escaping its local listener or inspected-page delivery boundary.
- Captured Evidence persisting beyond the documented DevTools session boundary without clear user control.
- Chrome Web Store release credentials, private keys, or service account material.
Use public support for
- UI bugs that contain no sensitive data.
- Incorrect COMMAND state reconstruction with sanitized payloads.
- Documentation gaps or product-boundary questions.
- Feature requests.
- Fixture or local build failures.
Review the Support page to choose the right public template.
Data-handling reminder
Workbench is designed to process Lightstreamer Evidence locally inside one Panel Session. The session owns one temporary Event History; controlled Close attempts erasure, while abnormal termination can defer cleanup to a later ownership-safe sweep. Residual data may remain until Chrome next runs the extension, but a new Panel Session never replays stale Evidence. Do not attach raw production event streams, exports, or screenshots containing sensitive application data to public issues or pull requests.