I tested the deployed source and the new Pack/Backup paths. The UX is impressively polished, but there is one security issue I would prioritize before promoting Packs more widely:
A crafted Pack can create stored DOM XSS after the user accepts it.parsePackCode() accepts any non-empty string as a channel ID. That value is stored, then later interpolated into inline handlers such as:
onclick="removeChannel('${esc(ch.id)}')"
esc() is appropriate for HTML text/attributes, but it is not a JavaScript-string encoder. Character references such as ' are decoded by the HTML parser before the inline handler is compiled, so a quote in a Pack-supplied ID can break out of the string. Backup import accepts the same untrusted object shape. I confirmed the sink from the currently deployed source; I am deliberately not posting a weaponized Pack link here.
A durable fix would be:
validate every imported channel ID against the exact YouTube channel-ID shape you support (for example ^UC[A-Za-z0-9_-]{22}$) before storing it;
validate/limit all imported string fields and deduplicate IDs;
stop generating inline onclick strings for imported data—render with DOM APIs, keep the ID in a property/dataset, and attach the click with addEventListener;
apply the same schema validator to both Pack and Backup import.
Two smaller trust/copy issues:
Kids Mode stores the six-digit PIN in plaintext localStorage, and the same-device user can read/remove ns_kids_pin or ns_kids_mode. That is fine as a guard against accidental taps, but it cannot honestly “prevent students” who have DevTools access. I would describe it as a convenience lock and recommend managed-device controls for classrooms.
The launch copy says “no ads, no data collection,” while the page loads Cloudflare Insights, Google Fonts and the official YouTube player; your own FAQ correctly says YouTube ads may appear. More precise copy would be “No NoSuggest ads or account/profile collection; YouTube player ads and external requests may occur.”
One bonus PWA fix: sw.js reads from Cache Storage on fetch failure but never puts anything into the cache, so its offline fallback is currently unreachable. Cache the app shell during install or remove the fallback claim/logic.
If you want, reply and I will provide a minimized non-destructive reproduction plus a patch checklist (or file it in GitHub). If this audit is useful, a zap on the review helps fund the follow-through ⚡
Appreciate the thorough audit — went through everything point by point.
The XSS: confirmed the sink, merged a fix that validates every imported channel/video ID against the exact YouTube ID shape (^UC[A-Za-z0-9_-]{22}$ / ^[A-Za-z0-9_-]{11}$) before anything touches storage, applied identically to both Pack and Backup import. Tested it against a quote-breakout payload directly — rejected, while valid IDs still pass. Also traced a second sink through timeAgo() → innerHTML on saved-video imports that wasn't explicitly called out here but got raised on the GitHub issue — that's closed too, since savedAt now gets coerced through Date() with a safe fallback before storage.
Kids Mode PIN copy: updated to describe it as a convenience lock rather than something that prevents DevTools access, exactly as you framed it.
"No data collection" copy: tightened. Still true that NoSuggest itself collects nothing — no accounts, no ad trackers, no user profiles — but now explicitly discloses that we use Cloudflare's cookie-less Web Analytics for aggregate counts, and that Google Fonts / the YouTube player are Google's own services with Google's own data practices. Precision over a flat claim, per your point.
sw.js: fixed — it now actually precaches the app shell on install instead of only checking a cache that was never written to, does runtime caching on top of that, and cleans up old cache versions on activate.
Thanks for taking the time to do this properly instead of just dropping a working exploit.
NoSuggest is a free PWA that strips YouTube down to just the channels you've chosen to follow, no recommendations, no Shorts, no auto-play, no trending feed. Nothing to pull you toward content you didn't come for.
It works instantly in any browser, no app install, no account, no sign-up.
No ads, no data collection, no premium tier. That's not a "free trial" model, it's the whole design: the tool works the same for everyone, forever, and the code is public so anyone can verify that claim rather than take it on faith.
It doesn't link to your YouTube account at all, no login, no OAuth, no permissions granted to Google. That's intentional, since account linking would mean re introducing the exact tracking/data-collection layer this tool exists to remove.
Instead, you add channels manually, search for a channel or paste its URL, and it gets added to your list.
Once a channel's on your list, that's the only content you will ever see, no algorithmic suggestions layered on top, no "based on your subscriptions" recommendations creeping back in.
One thing worth flagging, since it's a fair concern: playback uses YouTube's official embedded player under the hood, so views still get counted normally for the creator. Nobody's getting cheated out of view counts or revenue on their end, this strips the discovery layer, not the creator economics.
Also, seconding your first point, that Shorts push is exactly what pushed me to build NoSuggest.
Wow this is fantastic!!! when I go back to YouTube I think I will use this instead!! Does this block ads? I am a YouTube premium subscriber due to all the ads!
Thank you for the encouragement. Looking forward for you to use NoSuggest and share your feedback when you decide to use YouTube.
NoSuggest won't explicitly block ads. But Google itself won't serve ads most of the time in their iFrame player. So 99% of times, there will be no ads. This is an added advantage which we got, but not planned for.
Really appreciate you taking the time to try it out and the kind words, genuinely means a lot. And yes please, keep the feedback coming, this is exactly the kind of input that shapes the enhancements.
On video descriptions: No, video descriptions are not in the roadmap currently.
On NewPipe, that's a great comparison to raise, and I would actually frame it less as competing and more as solving different problems entirely:
NewPipe is built for privacy and ownership, no Google servers involved at all, fully de-Googled, which is a fantastic goal for people who want maximum control over their data and don't mind sideloading an APK to get there.
NoSuggest comes at it from a different angle: focus and intentional use. It uses YouTube's actual official player (so creators' views count normally, no funny business there), and leans into being a zero friction PWA, no app store, no install, works instantly on any device. That trade-off opens it up to use cases NewPipe isn't really aimed at, like a classroom or tutor wanting students to see only assigned videos, a parent setting up a locked-down kids mode, or someone at work who just wants YouTube to stop being a distraction machine.
So NewPipe if privacy/ownership is your priority, NoSuggest if the goal is cutting distraction while keeping things dead simple to set up. Different tools for genuinely different jobs, both good to have around like you did.
NoSuggest doesn't explicitly block or strip ads, there's no ad-blocking logic in there at all.
The reason it feels ad-free in practice comes down to using YouTube's official embedded iFrame player rather than reverse-engineering the app like NewPipe has to. YouTube's own embedded player serves very few to no ads at all compared to the full app/website experience, that's just how Google has built it, not something NoSuggest is doing on purpose.
So no cat-and-mouse game here, and no chasing patches every time YouTube ships an update. Since it's the real, sanctioned player, there's nothing for YouTube to "break" the way they do with NewPipe's reverse-engineered extraction.
That's actually one of the quieter benefits of this approach: what you see today should keep working the same way tomorrow.
I like to download YouTube videos so I can listen to them offline and not consume my data plan.
That’s the only reason I’m still paying for my $20 YouTube Premium plan (not sure if it’s worth it though cause unlimited data plans can be quite cheap now).
I suppose NoSuggest doesn’t let you download videos?
I tested the deployed source and the new Pack/Backup paths. The UX is impressively polished, but there is one security issue I would prioritize before promoting Packs more widely:
A crafted Pack can create stored DOM XSS after the user accepts it.
parsePackCode()accepts any non-empty string as a channel ID. That value is stored, then later interpolated into inline handlers such as:onclick="removeChannel('${esc(ch.id)}')"esc()is appropriate for HTML text/attributes, but it is not a JavaScript-string encoder. Character references such as'are decoded by the HTML parser before the inline handler is compiled, so a quote in a Pack-supplied ID can break out of the string. Backup import accepts the same untrusted object shape. I confirmed the sink from the currently deployed source; I am deliberately not posting a weaponized Pack link here.A durable fix would be:
^UC[A-Za-z0-9_-]{22}$) before storing it;onclickstrings for imported data—render with DOM APIs, keep the ID in a property/dataset, and attach the click withaddEventListener;Two smaller trust/copy issues:
localStorage, and the same-device user can read/removens_kids_pinorns_kids_mode. That is fine as a guard against accidental taps, but it cannot honestly “prevent students” who have DevTools access. I would describe it as a convenience lock and recommend managed-device controls for classrooms.One bonus PWA fix:
sw.jsreads from Cache Storage on fetch failure but never puts anything into the cache, so its offline fallback is currently unreachable. Cache the app shell duringinstallor remove the fallback claim/logic.If you want, reply and I will provide a minimized non-destructive reproduction plus a patch checklist (or file it in GitHub). If this audit is useful, a zap on the review helps fund the follow-through ⚡
Appreciate the thorough audit — went through everything point by point.
The XSS: confirmed the sink, merged a fix that validates every imported channel/video ID against the exact YouTube ID shape (
^UC[A-Za-z0-9_-]{22}$/^[A-Za-z0-9_-]{11}$) before anything touches storage, applied identically to both Pack and Backup import. Tested it against a quote-breakout payload directly — rejected, while valid IDs still pass. Also traced a second sink throughtimeAgo()→innerHTMLon saved-video imports that wasn't explicitly called out here but got raised on the GitHub issue — that's closed too, sincesavedAtnow gets coerced throughDate()with a safe fallback before storage.Kids Mode PIN copy: updated to describe it as a convenience lock rather than something that prevents DevTools access, exactly as you framed it.
"No data collection" copy: tightened. Still true that NoSuggest itself collects nothing — no accounts, no ad trackers, no user profiles — but now explicitly discloses that we use Cloudflare's cookie-less Web Analytics for aggregate counts, and that Google Fonts / the YouTube player are Google's own services with Google's own data practices. Precision over a flat claim, per your point.
sw.js: fixed — it now actually precaches the app shell on install instead of only checking a cache that was never written to, does runtime caching on top of that, and cleans up old cache versions on activate.
Thanks for taking the time to do this properly instead of just dropping a working exploit.
NoSuggest is a free PWA that strips YouTube down to just the channels you've chosen to follow, no recommendations, no Shorts, no auto-play, no trending feed. Nothing to pull you toward content you didn't come for.
It works instantly in any browser, no app install, no account, no sign-up.
No ads, no data collection, no premium tier. That's not a "free trial" model, it's the whole design: the tool works the same for everyone, forever, and the code is public so anyone can verify that claim rather than take it on faith.
I quit YouTube about two weeks ago due to this very reason. YouTube is pushing shorts now and I started to consume a lot of mindless content.
How does this link to your YouTube account to see your subs?
Hi @BlokchainB,
It doesn't link to your YouTube account at all, no login, no OAuth, no permissions granted to Google. That's intentional, since account linking would mean re introducing the exact tracking/data-collection layer this tool exists to remove.
Instead, you add channels manually, search for a channel or paste its URL, and it gets added to your list.
Once a channel's on your list, that's the only content you will ever see, no algorithmic suggestions layered on top, no "based on your subscriptions" recommendations creeping back in.
One thing worth flagging, since it's a fair concern: playback uses YouTube's official embedded player under the hood, so views still get counted normally for the creator. Nobody's getting cheated out of view counts or revenue on their end, this strips the discovery layer, not the creator economics.
Also, seconding your first point, that Shorts push is exactly what pushed me to build NoSuggest.
Thank you.
Wow this is fantastic!!! when I go back to YouTube I think I will use this instead!! Does this block ads? I am a YouTube premium subscriber due to all the ads!
Hi @BlokchainB,
Thank you for the encouragement. Looking forward for you to use NoSuggest and share your feedback when you decide to use YouTube.
NoSuggest won't explicitly block ads. But Google itself won't serve ads most of the time in their iFrame player. So 99% of times, there will be no ads. This is an added advantage which we got, but not planned for.
Thank you.
Just had a play with it, very cool 😎
Only question....
You can't see the video description?
NewPipe is very established and does it all but yours is a great addition and I've bookmarked it
Good work 👏
Hi @npub1zapsats,
Really appreciate you taking the time to try it out and the kind words, genuinely means a lot. And yes please, keep the feedback coming, this is exactly the kind of input that shapes the enhancements.
On video descriptions: No, video descriptions are not in the roadmap currently.
On NewPipe, that's a great comparison to raise, and I would actually frame it less as competing and more as solving different problems entirely:
NewPipe is built for privacy and ownership, no Google servers involved at all, fully de-Googled, which is a fantastic goal for people who want maximum control over their data and don't mind sideloading an APK to get there.
NoSuggest comes at it from a different angle: focus and intentional use. It uses YouTube's actual official player (so creators' views count normally, no funny business there), and leans into being a zero friction PWA, no app store, no install, works instantly on any device. That trade-off opens it up to use cases NewPipe isn't really aimed at, like a classroom or tutor wanting students to see only assigned videos, a parent setting up a locked-down kids mode, or someone at work who just wants YouTube to stop being a distraction machine.
So NewPipe if privacy/ownership is your priority, NoSuggest if the goal is cutting distraction while keeping things dead simple to set up. Different tools for genuinely different jobs, both good to have around like you did.
Thank you.
Another thing I meant to ask, if the video is playing legit, how do you hide the ads?
I know NewPipe have a constant cat and mouse game with YT over the framework of how the frontends mimic
YT change the code to effectively break NP, so I find myself going on a roundabout of different providers when one has worked out the latest fix
Hi @npub1zapsats,
NoSuggest doesn't explicitly block or strip ads, there's no ad-blocking logic in there at all.
The reason it feels ad-free in practice comes down to using YouTube's official embedded iFrame player rather than reverse-engineering the app like NewPipe has to. YouTube's own embedded player serves very few to no ads at all compared to the full app/website experience, that's just how Google has built it, not something NoSuggest is doing on purpose.
So no cat-and-mouse game here, and no chasing patches every time YouTube ships an update. Since it's the real, sanctioned player, there's nothing for YouTube to "break" the way they do with NewPipe's reverse-engineered extraction.
That's actually one of the quieter benefits of this approach: what you see today should keep working the same way tomorrow.
Thank you.
Great idea.
I like to download YouTube videos so I can listen to them offline and not consume my data plan.
That’s the only reason I’m still paying for my $20 YouTube Premium plan (not sure if it’s worth it though cause unlimited data plans can be quite cheap now).
I suppose NoSuggest doesn’t let you download videos?
Hi @teemupleb,
NoSuggest let's you save the videos, it's basically like bookmarking and not downloading. So you can't watch it offline.
We can't provide download option because we won't store any videos from YouTube.
Hoping it won't be a blocker for you to use NoSuggest.
Please try and share feedback.
Thank you.