Comment on page

Browser Extension Security

Controlling Access to Hosts/Origins
Access to hosts/origins is controlled via the runtime_blocked_hosts and runtime_allowed_hosts policies. See Configure ExtensionSettings policy for more information​
For example, to only allow PixieBrix to modify the example.com domain, provide the following settings:
runtime_blocked_hosts
*://*
runtime_allowed_hosts
https://*.pixiebrix.com
https://*.example.com
Frequently Asked Questions (FAQs)
What security certifications do you have?
PixieBrix has completed a SOC-2 Type 2 with A-LIGN covering the following trust criteria:
Security
Availability
Confidentiality
You can find an overview of our controls on our website's Security page.
Is the browser extension source available?
Yes, the browser extension is source-available on GitHub.
What browser permissions does PixieBrix's extension require?
See our Extension permissions section of our Privacy Policy.
Has a 3rd party audited the PixieBrix Browser Extension?
In July 2023, the latest independent penetration test by A-LIGN included the Browser Extension in the test scope. The penetration test report is available upon request
In August 2023, PixieBrix completed the Google Cloud Application Security Assessment (CASA)
The Google Chrome Web Store team reviews the extension prior to publishing in the Chrome Web Store
Could you explain your CRXcavator Extension Risk Report?
​You can view the CRXcavator report here.
CRXcavator is a tool from Duo Security to assess the risk of Browser Extensions automatically. As an automated scanning tool, its results must be put into context due to false positives.
Relative Risk Scores of Other Extensions
The PixieBrix extension is a leader compared to other enterprise automation extensions:
​UiPath: 481
​Zapier: 436
​PixieBrix: 428
​1Password: 293
Permissions
See the Extension permissions section of our Privacy Policy for a full explanation of what permissions our extension requests and why.
The Chrome Web Store team reviews the extension with respect to the stated purpose of each permission.
The main permissions risks flagged by CRXcavator are:
*://*/* host permission. PixieBrix includes support for running on any page/calling any API. As an IT admin, you can set the Chrome Extension policy to override this permission to allow/forbid certain origins
<all_urls> host permission. This permission is required for certain behaviors for compliance use cases (e.g., screenshot capture). As an IT admin, you can set the Chrome Extension policy to override this permission to allow/forbid certain origins
tabs permission. PixieBrix must be able to monitor tab events for navigation and cross-tab messaging/automation. PixieBrix does not transmit/collect information about URLs
Content Security Policy (CSP)
CRXcavator evaluates the extension’s Content Security Policy in the manifest. However, sub-components of the PixieBrix extension apply stricter policies where possible. The CRXcavator describes their point system for the Content Security Policy here​
The main CSP risks included in the CRXCavator score are:
connect-src: https:. Required for PixieBrix to be able to be make API calls for integrations
frame-src: https:. Required to support embedding iframes in custom panels.
image-src: https:. Required to support embedding logos/images for theming and custom panels
script-src: unsafe-eval:. Required for dynamic page modification and templating. PixieBrix does not request external Javascript
External Communications
CRXcavator scans for URLs/hostnames, including in locations that are not executed/interpreted
reactjs.org: false positive, the React web framework’s documentation site
jsonschema.org: false positive, PixieBrix uses the JSON Schema standard for input and output schemas. It does not connect to the site
app.pixiebrix.com: for API calls to the primary PixieBrix service

Extension Authentication Configuration

Network/Email Firewall Configuration

Last modified 28d ago