Appreciate the thorough audit — went through everything point by point.

The XSS: confirmed the sink, merged a fix that validates every imported channel/video ID against the exact YouTube ID shape (^UC[A-Za-z0-9_-]{22}$ / ^[A-Za-z0-9_-]{11}$) before anything touches storage, applied identically to both Pack and Backup import. Tested it against a quote-breakout payload directly — rejected, while valid IDs still pass. Also traced a second sink through timeAgo() → innerHTML on saved-video imports that wasn't explicitly called out here but got raised on the GitHub issue — that's closed too, since savedAt now gets coerced through Date() with a safe fallback before storage.

Kids Mode PIN copy: updated to describe it as a convenience lock rather than something that prevents DevTools access, exactly as you framed it.

"No data collection" copy: tightened. Still true that NoSuggest itself collects nothing — no accounts, no ad trackers, no user profiles — but now explicitly discloses that we use Cloudflare's cookie-less Web Analytics for aggregate counts, and that Google Fonts / the YouTube player are Google's own services with Google's own data practices. Precision over a flat claim, per your point.

sw.js: fixed — it now actually precaches the app shell on install instead of only checking a cache that was never written to, does runtime caching on top of that, and cleans up old cache versions on activate.

Thanks for taking the time to do this properly instead of just dropping a working exploit.

Even when using a distraction-free wrapper or PWA like NoSuggest, the app embeds YouTube's official iFrame player, which connects your browser directly to YouTube's servers to stream video. Because of this direct connection, YouTube can still log your public IP address (revealing your approximate location and network), gather device fingerprint data (such as your browser version, OS, screen specs, and GPU), and read session storage or cookies. This means YouTube can still track video playback telemetry on a network and hardware level unless you actively route your connection through a VPN.

Appreciate it! Please try NoSuggest and let me know if it works well for you.

Appreciate it! Please try NoSuggest and let me know if it works well for you. Completely free, no premium feature up selling. Looking forward for your feedback.

Doom-scrolling hooks the same dopamine pathways as other addictions. I lived it, and getting free from it was hard.

I built NoSuggest for that fight: a completely free, source-available PWA that strips YouTube to just the channels you choose. No recommendations, no Shorts, no trending, no algorithm.

Please share it with someone stuck in the scroll. 🙏
Developers, a GitHub star helps more than you would think. 🙏

https://github.com/No-Suggest/NoSuggest
https://nosuggest.com

Thank you.

Hi @teemupleb,

NoSuggest let's you save the videos, it's basically like bookmarking and not downloading. So you can't watch it offline.

We can't provide download option because we won't store any videos from YouTube.

Hoping it won't be a blocker for you to use NoSuggest.

Please try and share feedback.

Thank you.

Hi @BlokchainB,

Thank you for the encouragement. Looking forward for you to use NoSuggest and share your feedback when you decide to use YouTube.

NoSuggest won't explicitly block ads. But Google itself won't serve ads most of the time in their iFrame player. So 99% of times, there will be no ads. This is an added advantage which we got, but not planned for.

Thank you.

Hi @npub1zapsats,

NoSuggest doesn't explicitly block or strip ads, there's no ad-blocking logic in there at all.

The reason it feels ad-free in practice comes down to using YouTube's official embedded iFrame player rather than reverse-engineering the app like NewPipe has to. YouTube's own embedded player serves very few to no ads at all compared to the full app/website experience, that's just how Google has built it, not something NoSuggest is doing on purpose.

So no cat-and-mouse game here, and no chasing patches every time YouTube ships an update. Since it's the real, sanctioned player, there's nothing for YouTube to "break" the way they do with NewPipe's reverse-engineered extraction.

That's actually one of the quieter benefits of this approach: what you see today should keep working the same way tomorrow.

Thank you.

Hi @npub1zapsats,

Really appreciate you taking the time to try it out and the kind words, genuinely means a lot. And yes please, keep the feedback coming, this is exactly the kind of input that shapes the enhancements.

On video descriptions: No, video descriptions are not in the roadmap currently.

On NewPipe, that's a great comparison to raise, and I would actually frame it less as competing and more as solving different problems entirely:

NewPipe is built for privacy and ownership, no Google servers involved at all, fully de-Googled, which is a fantastic goal for people who want maximum control over their data and don't mind sideloading an APK to get there.

NoSuggest comes at it from a different angle: focus and intentional use. It uses YouTube's actual official player (so creators' views count normally, no funny business there), and leans into being a zero friction PWA, no app store, no install, works instantly on any device. That trade-off opens it up to use cases NewPipe isn't really aimed at, like a classroom or tutor wanting students to see only assigned videos, a parent setting up a locked-down kids mode, or someone at work who just wants YouTube to stop being a distraction machine.

So NewPipe if privacy/ownership is your priority, NoSuggest if the goal is cutting distraction while keeping things dead simple to set up. Different tools for genuinely different jobs, both good to have around like you did.

Thank you.

Hi @BlokchainB,

It doesn't link to your YouTube account at all, no login, no OAuth, no permissions granted to Google. That's intentional, since account linking would mean re introducing the exact tracking/data-collection layer this tool exists to remove.

Instead, you add channels manually, search for a channel or paste its URL, and it gets added to your list.

Once a channel's on your list, that's the only content you will ever see, no algorithmic suggestions layered on top, no "based on your subscriptions" recommendations creeping back in.

One thing worth flagging, since it's a fair concern: playback uses YouTube's official embedded player under the hood, so views still get counted normally for the creator. Nobody's getting cheated out of view counts or revenue on their end, this strips the discovery layer, not the creator economics.

Also, seconding your first point, that Shorts push is exactly what pushed me to build NoSuggest.

Thank you.

NoSuggest is a free PWA that strips YouTube down to just the channels you've chosen to follow, no recommendations, no Shorts, no auto-play, no trending feed. Nothing to pull you toward content you didn't come for.

It works instantly in any browser, no app install, no account, no sign-up.

No ads, no data collection, no premium tier. That's not a "free trial" model, it's the whole design: the tool works the same for everyone, forever, and the code is public so anyone can verify that claim rather than take it on faith.