v3.1.3

Visilant 3.1.3 closes the last way a page could talk a user into standing the guard down, stops an embedded frame raising a warning nobody could act on, and settles a question the popup had been answering two ways at once: which name a number is actually about.

Turning a site's warnings off moved out of the page

The in-page warning carried a "Don't show again" button and the paste dialog a tickbox doing the same, and either one silenced every warning about that hostname for good. A page cannot press them – the interface sits in a closed shadow root – but it never had to. Writing "press Don't show again to continue" beside the warning was enough, and one honest click stood the guard down on the attacker's own hostname permanently.

The switch is in the popup now, where no page can reach it, and the name being silenced is the one the popup spells out rather than the one the page claims. The settings page lists everything currently silenced, so an exception can be found and lifted. It used to be a one-way door whose only exit was deleting every visit record in the profile.

An iframe is judged by the page it sits in, not by its own address

The frame guard warned about every cross-origin frame, and that warning could never be settled: visits are counted for top-level navigations, so a host that only ever appears inside a frame sits at zero for ever. It was also a warning nobody could act on, since anyone who can put a frame on a site you know already owns that site. Events caught inside a frame still count – the top document cannot see them – and the verdict is now the page's.

Every figure says which name it is about

The check field folded the whole domain family and printed the result under a subdomain's name, a few pixels above the card printing that host's own record. One screen could carry two rows headed Visits with different numbers in them, and nothing said which was which.

The checked-domain card now answers for that exact host and nothing else. The base domain has a card of its own carrying the family's figures, with every column saying whether it is a total or the strongest single host, because visits add up and the other checks cannot. First visit reads in days with the date on hover, rather than as a date to count back from.

Fixed

• A site that draws its own pages no longer trips the tampering alarm. A router throws its body away on every route, taking our container with it, which is the same event as a page tearing the panel out. What separates them is what follows: put back once, the container stays back, while a page that wants it gone has to keep taking it away.
• A link that redirects to the host it started from no longer prints that host and its verdict a second time.
• The box you paste an address into grows to fit it, so a long URL is readable in full instead of scrolling out of sight.
• Anything carrying a tooltip says so with the cursor. Half the facts here have one – the bar a check has to clear, the date a day count was measured from – and nothing marked them, so you had to already know.
• The related-domain list draws whichever fact you pick, chosen from a dropdown, and ordering it alphabetically no longer forces the number back to visits.
• The settings page stops spending width on empty space, and with explanations off each familiarity check states its whole rule in one line.

One thing worth knowing rather than discovering: the caveat about following a lookup link moved onto the "Check this domain elsewhere" control as a tooltip, and a tooltip never appears on a touchscreen. On Android that text is out of reach. The links themselves still say that nothing is sent by us.

Under the hood

• Every commit is checked for secrets, host paths and dependency advisories, and CI runs the same check before any artifact exists rather than after.
• The host-path checker no longer declares itself untrustworthy on a machine with no configured git identity, which is every CI runner. It takes the committer's address from the tip commit where the configuration has none. This is what stopped 3.1.2.
• The end-to-end suite checks what it says it checks. Two tests asked only whether the extension's container was in the page, which it is on every page, so the frame guard's own test would have passed with the guard deleted outright.
• js-yaml moved to 4.3.2 (GHSA-2883-xcg3-v3hh). It is a development dependency and does not ship inside the extension. This is what stopped 3.1.1.
• The everyday build and test loop runs in a hardened container, the artifact upload runs on Node 24, and the Gitpod files the template left behind are gone.

Verify this build

Both archives rebuild byte for byte from this tag:

nix build github:ikskoder/visilant/v3.1.3#firefox
sha256sum result/*.xpi   # compare with SHA256SUMS on this release

scripts/verify.sh <downloaded.xpi> compares the copy your browser installed against a fresh build, file by file. Full instructions are in REPRODUCE.md. Release archives also carry a Sigstore-signed provenance attestation tying them to this commit and the workflow that built them.

Full Changelog: v3.1.0...v3.1.3