[Security] Chrome extension broadcasts auth token to all listeners via health message

[mr-k-man]

Summary

extension/background.js:80 — The auth token is included in chrome.runtime.sendMessage({ type: 'health', data: { ...healthData, token: authToken } }) which broadcasts to ALL extension components. If the sidepanel has an XSS vulnerability, the token is immediately compromised and can be used to make authenticated requests to the browse server.

Impact

Medium — violates principle of least privilege. The token should only be delivered to the component that needs it, not broadcast to all listeners.

Fix

PR #664 removes the token from the health broadcast. The sidepanel now requests it via a targeted getToken message with sendResponse, which only delivers to the requesting component.

Found via sqry AST-based semantic code graph analysis.