Dashlane Publishes Web Extension Code for Transparency and Security

Dashlane has made the source code for its web extension publicly available, marking another step in its ongoing commitment to transparency. While this move aims to build trust and foster collaboration with the cybersecurity and developer communities, Dashlane clarifies that this is not a traditional open-source initiative. Key proprietary elements and sensitive components have been redacted to safeguard intellectual property and security.

Unlike full open-source releases, Dashlane’s shared codebase is not designed to enable others to build a replica of its web extension. The company likens the release to sharing a recipe with a few proprietary ingredients left out. This approach allows developers and researchers to understand Dashlane’s approach to browser extension development while protecting its core technologies.

This release targets several audiences:

• IT security professionals: A chance to review the code for compliance and security practices.
• Developers: Insights into Manifest V3-based extensions and the ability to provide feedback through GitHub.
• White-hat hackers: An invitation to identify vulnerabilities, reportable through Dashlane’s HackerOne Bug Bounty program.

To manage the risks of public sharing, Dashlane uses a secure process to review and redact its code. The process involves an internal tool that removes sensitive information, such as test data and internal references, before mirroring the repository to GitHub. Automated checks and configuration files ensure that only approved elements are made public.

Sections of the code flagged as sensitive are excluded through “magic comments,” which prevent accidental exposure during refactoring or renaming. This process underscores Dashlane’s focus on balancing transparency with security.

This latest move follows Dashlane’s earlier releases of its mobile and command-line codebases, positioning the company as a proponent of greater openness in the tech industry. However, unlike fully open-sourced password management products like Bitwarden and KeePass, Dashlane retains significant control over how its shared code is used and distributed.

Founded in 2009, Dashlane is a major player in the password management industry, with millions of users worldwide. The company emphasizes its zero-knowledge architecture, where cryptographic operations occur on client devices. For a full review of Dashlane, check out this in-depth analysis by our team.

Dashlane has hinted that future steps might include sharing parts of its backend codebase, though no timeline has been provided. For now, the focus remains on refining its public repositories and encouraging collaboration while maintaining high-security standards.