WatDesk keeps all data in the browser's local extension storage and has no server. Supported version: the latest release.

Please use GitHub's private vulnerability reporting for this repository (Security tab → Report a vulnerability). Do not post exploit details, passwords or private academic records in a public issue. We aim to acknowledge reports within 7 days.

In scope: the extension code in src/, its manifest and permissions, and the packaged release. Out of scope: vulnerabilities in the University of Waterloo, LEARN, Crowdmark, Odyssey or other third-party services, and the vendored WATnow files beyond how WatDesk uses them.