Document the content-script injection / message-passing security model

[aadityat23]

Category: Cybersecurity / Extension · Difficulty: Intermediate · Effort: Medium · Priority: Contributor-friendly

Skills: Chrome extensions, postMessage security, threat modeling basics

Good for: Cybersecurity Intern

Description: The extension has background/, content/, and messaging/ directories implying a background↔content-script message-passing architecture. This is a classic extension attack surface (message spoofing from a malicious page) that isn't documented anywhere in SECURITY.md, which currently only covers backend/frontend/SDK/ingestion.

Expected outcome: A short threat-model writeup covering what messages are trusted, origin validation (if any), and recommendations.

Acceptance criteria:

• Document reviewed by a maintainer; any concrete vulnerability found is filed as a separate, appropriately-labeled security issue (not fixed silently in this doc PR).

Files: finverify-extension/apps/extension/src/{background,content,messaging}, SECURITY.md

Labels: security, extension, intermediate