Reading Time

What it asks for

• No networkPromises to contact no server. The app scans the code and refuses the file if it calls fetch, XMLHttpRequest, WebSocket, EventSource or sendBeacon.

Permissions are a declaration and a guard rail, not a sandbox. They limit what the wayBetter API hands this plugin; a plugin is still JavaScript in the page, with the page’s own access. The code below is what actually runs.

The code

Open the raw file to read it.

How installing works, and is it safe?

1. A link, not an installer. “Install in wayBetter” is a waybetter:// link. It opens the app and proposes this plugin. A web page cannot install anything, and neither can a tab inside the app.
2. The app checks the file. It downloads the file itself, verifies the Store catalog’s Ed25519 signature with the key compiled into the app, then this file’s size and SHA-256 against the catalog.
3. You read it, then confirm. The install screen shows the name, author, version, source, SHA-256, the permissions it declares, what a scan of the code found and the code. Nothing is written until you press Install.

What this does not promise: a plugin runs inside the page with the page’s own access, and a scan cannot see through minified or obfuscated code. Install what you would trust as a browser extension. Anything in the signed catalog is vouched for by the Store key, which is kept offline.