Skip to content

Security and verifying releases

Guarantees and how they are checked

Guarantee Check
The collector makes no network requests A static check of every bundle for network, cookie, storage, clipboard-read and fingerprinting APIs, plus browser tests that fail on any request (Chromium, Firefox, WebKit)
No answer text, key values or clipboard contents leave the page Browser tests type and paste marker text and check that no payload contains it
The survey never breaks Tests remove or break the collector and the platform runtime and check that answering and submitting still work
Small enough to load fast Each bundle is limited to 15 KB gzip in CI
Zero runtime dependencies The collector imports no third-party code

Reporting a vulnerability

Report problems privately through GitHub's private vulnerability reporting. We acknowledge reports within 3 business days and aim to fix or mitigate within 30 days. In scope: anything that could make the collector send data, capture content, break a host survey, or compromise release integrity.

Supply chain

  • Releases are built and published from GitHub Actions. npm packages carry provenance that links each file to the commit and workflow that built it.
  • Each GitHub Release lists the SHA-256 and SRI (sha384) hash of every browser file, together with ready-to-paste <script> tags.
  • Always pin an exact version in CDN links and keep the integrity attribute. The browser then refuses to run a file that differs from the published one.
  • An inline build (lydite.qualtrics.header.html) is available for institutions that do not allow external scripts.

Verifying a download

Check a file from the release page or the CDN against the published SHA256SUMS:

sha256sum -c SHA256SUMS --ignore-missing

Or compute the SRI hash yourself and compare it with your integrity attribute:

openssl dgst -sha384 -binary lydite.qualtrics.min.js | openssl base64 -A

Reproducible builds

The build is deterministic: the same source produces byte-identical files, which CI checks on every change by building twice from clean. To confirm that a release was built from its tagged source:

git clone https://github.com/zhihz/lydite && cd lydite
git checkout v0.1.0
corepack enable && pnpm install --frozen-lockfile
pnpm build
node scripts/check-reproducible.mjs --against path/to/downloaded/SHA256SUMS

Use Node.js 22 (the version used in CI). The lockfile pins every build tool.