From 503d50bcb27d7e2124335b117e38441c74ddcf9b Mon Sep 17 00:00:00 2001 From: Richard McCorkle Date: Mon, 18 May 2026 15:09:48 +0200 Subject: [PATCH] docs: note the bundled-library base64 calls in README Static analysis flags atob()/btoa() calls in the bundle. Disclose in Privacy & Security that they all originate in bundled libraries and are routine base64 operations, not obfuscation. Co-Authored-By: Claude Opus 4.7 --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 6d597ec..95de501 100644 --- a/README.md +++ b/README.md @@ -115,6 +115,8 @@ No user data is stored on servers operated by the plugin author. The plugin also bundles `langsmith` as a transitive dependency of `@langchain/core`. `langsmith` is LangChain's optional tracing library and contains a background cache-refresh timer. TubeSage never enables LangSmith tracing and never sets a LangSmith API key, so this code stays dormant and performs no background network transmission. +Static analysis of the bundled `main.js` shows a few `atob()`/`btoa()` (base64) calls. These all originate in bundled libraries, not in TubeSage's own code, and are all routine: decoding embedding vectors and image data URLs, reading a JWT header, and encoding Mermaid diagram syntax for rendering. None of them obscure code, API keys, or URLs. + ### Vault and system access - **Vault files**: TubeSage lists the folders and Markdown files in your vault so you can choose where notes are saved and pick template files. It reads and writes only the note and template files involved in processing. - **Clipboard**: the "Copy template" button in the template viewer writes template text to your system clipboard. TubeSage never reads the clipboard.