From 77203fe8fd5efd95cb0e79d0dc69ed0c081cb8b2 Mon Sep 17 00:00:00 2001
From: KoalaDev <6156589+Shik3i@users.noreply.github.com>
Date: Sun, 28 Jun 2026 08:35:05 +0200
Subject: [PATCH] fix(extension): drop unused roomPassword field from
 GET_STATUS response
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Defense-in-depth: the field was always undefined in practice (no code
path ever sets currentRoom.password — verified across the full git
history), and no GET_STATUS caller in the codebase reads it. But if a
future change ever populated currentRoom.password, any caller of
GET_STATUS would receive it in cleartext.

Threat surface today is narrow (externally_connectable is not set, no
content script sends GET_STATUS, only the popup uses it), but the field
has no reason to exist — removing it eliminates the future-leak vector
for free.

Backward compatible: no caller reads this field, so removing it is a no-op
for every existing code path.
---
 extension/background.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/extension/background.js b/extension/background.js
index f40fe4c..f8e3f94 100644
--- a/extension/background.js
+++ b/extension/background.js
@@ -1744,7 +1744,6 @@ async function handleAsyncMessage(message, sender, sendResponse) {
             serverUrl: currentServerUrl,
             version: chrome.runtime.getManifest().version,
             protocolVersion: PROTOCOL_VERSION,
-            roomPassword: currentRoom ? currentRoom.password : null,
             ping: currentPingMs,
             controlMode,
             hostPeerId,