Atrium — New Tab & Start Page 作者： Spruiid

Build process: none. The extension is plain ES modules loaded directly by

the new tab page. Nothing is minified, bundled, transpiled, or fetched at
runtime. What you see in the archive is what runs. tools/ contains
development helpers and is not part of the package.Remote code: none. The manifest sets script-src 'self'. Nothing is
evaluated from a string, and no external script or stylesheet is loaded.Permissions at install: storage only. Every host permission is inoptional_host_permissions and is requested by the widget that needs it, at
the moment the user first enables it, from a click handler. topSites andbookmarks are optional and only requested if the user points the speed dial
at them.Why *://*/* is in optional_host_permissions: the News widget can read
any RSS/Atom feed the user pastes in. The URL is not known in advance, so the
permission is requested for that origin only when the user adds a custom
feed. The named API domains above it cover the built-in sources
(Open-Meteo, CoinGecko, GitHub, Hacker News, Lobsters).Data collection: required: ["none"] — the extension has no server, no
account, and no analytics, and sends nothing to the developer. The three
optional types map to three opt-in features and are requested together with
the corresponding host permission: locationInfo (the place name typed into
the Weather widget goes to Open-Meteo for geocoding), searchTerms (search
suggestions, off by default, sends keystrokes to DuckDuckGo),browsingActivity (remote favicons, off by default, reveals speed-dial
domains to icons.duckduckgo.com).Handling of fetched content: no network response is ever assigned toinnerHTML. RSS is parsed with DOMParser and only text nodes are used; the
GitHub contribution calendar is parsed the same way and only the data-date
and data-level attributes are read. All URLs from remote sources pass
through safeURL() in src/core/dom.js, which rejects anything that is nothttp: or https:.Optional GitHub token: stored in storage.local and sent only toapi.github.com as an Authorization header. It is never logged, and the
settings export strips every field a widget declares as password, so a
backup file never carries it.Testing: load the add-on and open a new tab. Widgets that need network
access show an "Allow access" button; click it to grant the origin. The
Weather widget defaults to Vienna, the GitHub widget needs a username in its
options (the gear icon on the card).