security: add TODO comments for password plaintext over runtime.sendMessage

2026-02-27 11:36:19 -08:00
parent b478d9efa9
commit f13cd0fd47
2 changed files with 14 additions and 2 deletions
--- a/src/popup/views/approval.js
+++ b/src/popup/views/approval.js
@@ -385,6 +385,7 @@ function init(ctx) {
                type: "AUTISTMASK_TX_RESPONSE",
                id: approvalId,
                approved: true,
+                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
                password: password,
            },
            (response) => {
@@ -424,6 +425,7 @@ function init(ctx) {
                type: "AUTISTMASK_SIGN_RESPONSE",
                id: approvalId,
                approved: true,
+                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
                password: password,
            },
            (response) => {