marimo Glance Chrome extension security report

Marimo Glance — run marimo notebooks live, right where you find them. marimo notebooks are just Python files, so GitHub, gists, and GitLab display them as plain source code. Marimo Glance detects a real notebook and adds a “Switch to interactive marimo notebook” button in the corner of the page. One click replaces the raw Python with a fully interactive notebook you can run, edit, and explore — without leaving the page, cloning the repo, or installing anything. “See original” flips you back to the source at any time. HOW IT WORKS The extension watches the files you open on github.com, gist.github.com, and gitlab.com. On a .py file it looks for a genuine top-level marimo app declaration, so ordinary Python files — and passing mentions of marimo in comments or strings — are left completely alone. When it finds a notebook, it boots it live through the marimo.app playground, running entirely in WebAssembly inside your browser. YOUR CODE STAYS ON YOUR MACHINE The notebook source is packed into the page URL’s fragment (the part after #) and handed straight to the in-browser WebAssembly runtime. Browsers never send that fragment to any server, so your code — private repositories included — is never uploaded by the extension. The one exception is if you deliberately choose “Open in molab” from inside the notebook, which sends your code to molab to run and share there. GOOD TO KNOW • Runs WebAssembly-compatible notebooks only — anything depending on packages or features unavailable under Pyodide won’t run in the embed. • The interactive notebook is a scratch space: run and tweak cells freely, but edits aren’t saved back to GitHub or GitLab, and a refresh starts fresh from the original source. • Switching between interactive and source never restarts a running notebook. Works on GitHub blobs, GitHub gists, and GitLab blobs.