#50 Tighten remote IPC capabilities (drop meta.com/oculus.com, scope opener)

[Anonymous]

Originally created by: kristofferR

`capabilities/default.json` grants IPC — including `opener:allow-open-url` — to all of `.facebook.com`, `.fbcdn.net`, `.fbsbx.com`, `.meta.com`, and `*.oculus.com`. Any script running on those origins (not just Carrier's injected code) can invoke the allowed commands.

• Drop `meta.com`/`oculus.com` if Messenger never navigates there (verify against `AUTH_HOSTS` in `messenger.js` — they may only be login redirect hosts that never need IPC).
• Consider scoping the opener permission.
• Document the `csp: null` + ATS-allows-arbitrary-loads + library-validation-disabled combination as a conscious tradeoff.

[Anonymous]

Originally posted by: kristofferR

Done in [#60]: meta.com/oculus.com dropped from the remote IPC capability — they only appear during Meta-account login redirects, where the injected features fail soft. The capability description now documents why the list stays minimal.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed