The one-paragraph security review: Progress Report is a browser extension that runs only
on your Canvas domain, only after a teacher clicks it, using that teacher's own session
— it holds no credentials and no API tokens. It makes standard Canvas REST calls
the teacher could make themselves. Its only outside traffic is a licence check and
anonymous usage counts to phowell.org: a random install id, never names,
grades, or course content.
activeTab, storage, scripting,
and an optional host permission the teacher grants for your Canvas domain only.Rolling this out beyond one teacher? Department licensing covers ten seats under one key, with one invoice.