I am curios whether there exist a side-channel possibilities for emacs company-mode.

I thought, since company-mode suggests words that matches the given prefix, the suggestions may leak some sort of information of what is being typed.

Since I am a complete novice to emacs source code, I want to see how company mode is working internally...

Where can be the best starting point to look at the source tree?

  • 2
    You might want to develop a proper threat model before investigating any further. Suppose someone had access to that Emacs session, they could just install a hook that logs the pressed keys. No need to look at what company-mode displays, unless you define your attacker only able of shoulder-surfing (in which case, why can't they just look at the keyboard?).
    – wasamasa
    Commented Feb 26, 2019 at 8:05

1 Answer 1


company-mode is not part of Emacs, it's independently developed on GitHub: https://github.com/company-mode/company-mode

  • (This answers the part of the question about the location of the source code.)
    – Drew
    Commented Feb 26, 2019 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.