Closes #163. Documentation
only: docs/README.md and one TODO.md line. No code, config, script, CI or
build file is touched.
What changed
No competitor is named. The opening section, the derivation-path note and
the FAQ make their points without names, modelled on README.md's opening.
The FAQ entry now says the standard m/44'/60'/0'/0 path is used, so a phrase
is portable in both directions.
The false "no remote phishing blocklist" claim is gone. It is replaced by
an accurate description: a copy is bundled at build time, and the live list is
fetched on background startup and every 24 hours.
External Services now lists all five destinations, each with what is sent
and when: RPC endpoint, Blockscout, CoinDesk, the phishing blocklist fetch,
and the Etherscan address-label lookup.
Password statements corrected to cover transaction signing, message and
typed-data signing, private key export and wallet deletion.
Add Wallet is documented as the three tabs that exist (phrase, private
key, xprv). The nonexistent "Have a private key instead?" link is gone.
Settings matches the shipped screen: tracked tokens, network selector,
theme, UTC timestamps, About.
Other corrections found while verifying: the known-token list is ~500 tokens,
not ~250; tokens with a balance do appear without being added manually
(filtered by known-list / tracked / holder count), so the "no token
auto-discovery" claim was rewritten; Sepolia is supported, so the "mainnet
only" FAQ and the Receive warning were corrected; button labels are "Import",
"Sign & Send", "Confirm" and "Sign".
Claims verified against source
Claim
Source
RPC + Blockscout defaults, both networks
src/shared/networks.js, src/shared/constants.js
Balance/token-balance/tx-history fetches and their spam filtering
Known-token list size (511 entries) and scam-address list
src/shared/tokenList.js, src/shared/scamlist.js
60-second confirmation timeout and Etherscan link on the result screens
src/popup/views/txStatus.js:40-47,84,169,206
Verification
make fmt run; the formatted result is in the commit.
make check on the branch rebased onto next at b882ced:
Test Suites: 8 passed, 8 total
Tests: 149 passed, 149 total
All matched files use Prettier code style! (lint)
All matched files use Prettier code style! (fmt-check)
The same checks executed uncached inside the container image
(docker build --no-cache .), so the layer demonstrably ran rather than
reporting CACHED:
#11 [7/8] RUN make check
#11 6.757 Test Suites: 8 passed, 8 total
#11 6.757 Tests: 149 passed, 149 total
#11 21.60 All matched files use Prettier code style!
#11 30.33 All matched files use Prettier code style!
Left alone deliberately
The "Work on both Chrome and Firefox" guideline is untouched. It is a stated
project goal that also appears in README.md; that Firefox is currently
broken is tracked in #153, and rewriting a
policy statement is not this issue's scope.
The blocklist host is named as raw.githubusercontent.com rather than by
repository path, because the upstream path contains a competitor's name.
Closes [#163](https://git.eeqj.de/sneak/AutistMask/issues/163). Documentation
only: `docs/README.md` and one `TODO.md` line. No code, config, script, CI or
build file is touched.
## What changed
- **No competitor is named.** The opening section, the derivation-path note and
the FAQ make their points without names, modelled on `README.md`'s opening.
The FAQ entry now says the standard `m/44'/60'/0'/0` path is used, so a phrase
is portable in both directions.
- **The false "no remote phishing blocklist" claim is gone.** It is replaced by
an accurate description: a copy is bundled at build time, and the live list is
fetched on background startup and every 24 hours.
- **External Services now lists all five destinations**, each with what is sent
and when: RPC endpoint, Blockscout, CoinDesk, the phishing blocklist fetch,
and the Etherscan address-label lookup.
- **Password statements corrected** to cover transaction signing, message and
typed-data signing, private key export and wallet deletion.
- **Add Wallet** is documented as the three tabs that exist (phrase, private
key, xprv). The nonexistent "Have a private key instead?" link is gone.
- **Settings** matches the shipped screen: tracked tokens, network selector,
theme, UTC timestamps, About.
- Other corrections found while verifying: the known-token list is ~500 tokens,
not ~250; tokens with a balance do appear without being added manually
(filtered by known-list / tracked / holder count), so the "no token
auto-discovery" claim was rewritten; Sepolia is supported, so the "mainnet
only" FAQ and the Receive warning were corrected; button labels are "Import",
"Sign & Send", "Confirm" and "Sign".
## Claims verified against source
| Claim | Source |
| --- | --- |
| RPC + Blockscout defaults, both networks | `src/shared/networks.js`, `src/shared/constants.js` |
| Balance/token-balance/tx-history fetches and their spam filtering | `src/shared/balances.js`, `src/shared/transactions.js` |
| Refresh cadence: 10s while popup open, 60s in background | `src/popup/index.js:271`, `src/background/index.js:594-612` |
| ENS forward resolution on send; reverse lookups cached 12h | `src/popup/views/send.js:209`, `src/shared/ens.js` |
| CoinDesk endpoint, top-25 symbols only, 5-minute cache, popup-only, skipped on testnet | `src/shared/tokenList.js:10,3621-3646`, `src/shared/prices.js`, `src/popup/index.js:45` |
| Phishing blocklist: bundled copy, live fetch on startup and every 24h, delta persisted under 256 KiB | `src/shared/phishingDomains.js:14-23,134-168`, `src/background/index.js:614-618` |
| Phishing warning on all three approval screens | `src/popup/index.html` (`approve-tx`/`approve-sign`/`approve-site-phishing-warning`) |
| Etherscan label lookup happens on the send confirmation screen only | `src/shared/etherscanLabels.js:81-104`, `src/shared/addressWarnings.js:103`, `src/popup/views/confirmTx.js:270` |
| Password required for send, dApp tx, message/typed-data sign, key export, wallet delete | `src/popup/views/confirmTx.js:291`, `src/popup/views/approval.js:476,567`, `src/popup/views/addressDetail.js:327`, `src/popup/views/deleteWallet.js:32` |
| Argon2id + XSalsa20-Poly1305 at rest | `src/shared/vault.js:19-55` |
| Derivation path `m/44'/60'/0'/0`, 12-word generation | `src/shared/constants.js` (`BIP44_ETH_PATH`), `src/shared/wallet.js:7-17,24-36` |
| Add Wallet tabs, Settings wells, Add Token, Receive, approval buttons | `src/popup/index.html:60-181,782-1064,1313-1470`, `src/popup/views/addWallet.js:280-282` |
| Filter defaults and thresholds (1,000 holders, 100,000 gwei dust) | `src/shared/state.js:23-32`, `src/shared/transactions.js:240-257` |
| Known-token list size (511 entries) and scam-address list | `src/shared/tokenList.js`, `src/shared/scamlist.js` |
| 60-second confirmation timeout and Etherscan link on the result screens | `src/popup/views/txStatus.js:40-47,84,169,206` |
## Verification
`make fmt` run; the formatted result is in the commit.
`make check` on the branch rebased onto `next` at `b882ced`:
```
Test Suites: 8 passed, 8 total
Tests: 149 passed, 149 total
All matched files use Prettier code style! (lint)
All matched files use Prettier code style! (fmt-check)
```
The same checks executed uncached inside the container image
(`docker build --no-cache .`), so the layer demonstrably ran rather than
reporting `CACHED`:
```
#11 [7/8] RUN make check
#11 6.757 Test Suites: 8 passed, 8 total
#11 6.757 Tests: 149 passed, 149 total
#11 21.60 All matched files use Prettier code style!
#11 30.33 All matched files use Prettier code style!
```
## Left alone deliberately
- The "Work on both Chrome and Firefox" guideline is untouched. It is a stated
project goal that also appears in `README.md`; that Firefox is currently
broken is tracked in
[#153](https://git.eeqj.de/sneak/AutistMask/issues/153), and rewriting a
policy statement is not this issue's scope.
- The blocklist host is named as `raw.githubusercontent.com` rather than by
repository path, because the upstream path contains a competitor's name.
Rewrote the user guide against the code:
- No competitor is named anywhere; the opening, the derivation-path note
and the FAQ make their points without them.
- Removed the false "no remote phishing blocklist" claim. The blocklist
fetch is documented as what it is: a bundled copy plus a live fetch on
background startup and every 24h.
- External Services now lists all five destinations (RPC, Blockscout,
CoinDesk, phishing blocklist, Etherscan label lookup) with what is sent
and when.
- Password statements cover transaction signing, message and typed-data
signing, private key export and wallet deletion.
- Add Wallet is documented as the three tabs that exist (phrase, private
key, xprv), not a nonexistent link.
- Settings matches the shipped screen: tracked tokens, network selector,
theme, UTC timestamps, About.
- Corrected token-list size, token discovery behaviour, Sepolia support,
and the send/approval button labels.
clawbot
self-assigned this 2026-08-11 14:23:08 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #163. Documentation
only:
docs/README.mdand oneTODO.mdline. No code, config, script, CI orbuild file is touched.
What changed
the FAQ make their points without names, modelled on
README.md's opening.The FAQ entry now says the standard
m/44'/60'/0'/0path is used, so a phraseis portable in both directions.
an accurate description: a copy is bundled at build time, and the live list is
fetched on background startup and every 24 hours.
and when: RPC endpoint, Blockscout, CoinDesk, the phishing blocklist fetch,
and the Etherscan address-label lookup.
typed-data signing, private key export and wallet deletion.
key, xprv). The nonexistent "Have a private key instead?" link is gone.
theme, UTC timestamps, About.
not ~250; tokens with a balance do appear without being added manually
(filtered by known-list / tracked / holder count), so the "no token
auto-discovery" claim was rewritten; Sepolia is supported, so the "mainnet
only" FAQ and the Receive warning were corrected; button labels are "Import",
"Sign & Send", "Confirm" and "Sign".
Claims verified against source
src/shared/networks.js,src/shared/constants.jssrc/shared/balances.js,src/shared/transactions.jssrc/popup/index.js:271,src/background/index.js:594-612src/popup/views/send.js:209,src/shared/ens.jssrc/shared/tokenList.js:10,3621-3646,src/shared/prices.js,src/popup/index.js:45src/shared/phishingDomains.js:14-23,134-168,src/background/index.js:614-618src/popup/index.html(approve-tx/approve-sign/approve-site-phishing-warning)src/shared/etherscanLabels.js:81-104,src/shared/addressWarnings.js:103,src/popup/views/confirmTx.js:270src/popup/views/confirmTx.js:291,src/popup/views/approval.js:476,567,src/popup/views/addressDetail.js:327,src/popup/views/deleteWallet.js:32src/shared/vault.js:19-55m/44'/60'/0'/0, 12-word generationsrc/shared/constants.js(BIP44_ETH_PATH),src/shared/wallet.js:7-17,24-36src/popup/index.html:60-181,782-1064,1313-1470,src/popup/views/addWallet.js:280-282src/shared/state.js:23-32,src/shared/transactions.js:240-257src/shared/tokenList.js,src/shared/scamlist.jssrc/popup/views/txStatus.js:40-47,84,169,206Verification
make fmtrun; the formatted result is in the commit.make checkon the branch rebased ontonextatb882ced:The same checks executed uncached inside the container image
(
docker build --no-cache .), so the layer demonstrably ran rather thanreporting
CACHED:Left alone deliberately
project goal that also appears in
README.md; that Firefox is currentlybroken is tracked in
#153, and rewriting a
policy statement is not this issue's scope.
raw.githubusercontent.comrather than byrepository path, because the upstream path contains a competitor's name.
8c77b63425to771befc663