Browser Extension Security

This page covers Browser Extension Security topics. For general PixieBrix security and compliance information, see Security and Compliance

Controlling Access to Hosts/Origins

Access to hosts/origins is controlled via the runtime_blocked_hosts and runtime_allowed_hosts policies. See Configure ExtensionSettings policy for more information

The PixieBrix extension requires access to thepixiebrix.com domain and subdomains to function

For example, to only allow PixieBrix to modify the example.com domain, provide the following settings:

• runtime_blocked_hosts

  • *://*

• runtime_allowed_hosts

  • https://*.pixiebrix.com

  • https://*.example.com

Frequently Asked Questions (FAQs)

What security certifications do you have?

PixieBrix has completed a SOC-2 Type 2 with A-LIGN covering the following trust criteria:

• Security

• Availability

• Confidentiality

You can find an overview of our controls on our website's Security page. The SOC-2 includes the browser extension.

Is the browser extension source available?

Yes, the browser extension is source-available on GitHub.

What browser permissions does PixieBrix's extension require?

See our Extension permissions section of our Privacy Policy.

Has a 3rd party audited the PixieBrix Browser Extension?

• In July 2023, the latest independent penetration test by A-LIGN included the Browser Extension in the test scope. The penetration test report is available upon request
• In August 2023, PixieBrix completed the Google Cloud Application Security Assessment (CASA)

• The Google Chrome Web Store team reviews the extension prior to publishing in the Chrome Web Store

Could you explain your CRXcavator Extension Risk Report?

You can view the CRXcavator report here.

CRXcavator is a tool from Duo Security to assess the risk of Browser Extensions automatically. As an automated scanning tool, its results must be put into context due to false positives.

Relative Risk Scores of Other Extensions

The PixieBrix extension is a leader compared to other enterprise automation extensions:

• UiPath: 481
• Zapier: 436
• PixieBrix: 376
• 1Password: 293

Permissions

See the Extension permissions section of our Privacy Policy for a full explanation of what permissions our extension requests and why.

The Chrome Web Store team reviews the extension with respect to the stated purpose of each permission.

The main permissions risks flagged by CRXcavator are:

• <all_urls> host permission. This permission is required for certain behaviors for compliance use cases (e.g., screenshot capture). As an IT admin, you can set the Chrome Extension policy to override this permission to allow/forbid certain origins

• tabs permission. PixieBrix must be able to monitor tab events for navigation and cross-tab messaging/automation. PixieBrix does not transmit/collect information about URLs

Content Security Policy (CSP)

CRXcavator evaluates the extension’s Content Security Policy in the manifest. However, sub-components of the PixieBrix extension apply stricter policies where possible. The CRXcavator describes their point system for the Content Security Policy here

The main CSP risks included in the CRXCavator score are:

• connect-src: https: , http: Required for PixieBrix to be able to be make API calls for integrations

• frame-src: https:. Required to support embedding iframes in custom panels.

• image-src: https:. Required to support embedding logos/images for theming and custom panels

• script-src: unsafe-eval:. Required for dynamic page modification and templating. PixieBrix does not request external Javascript

External Communications

CRXcavator scans for URLs/hostnames, including in locations that are not executed/interpreted

• reactjs.org: false positive, the React web framework’s documentation site

• jsonschema.org: false positive, PixieBrix uses the JSON Schema standard for input and output schemas. It does not connect to the site

• app.pixiebrix.com: for API calls to the primary PixieBrix service