Two bugs found:
1. Individual name parts ("Ademo"→"John", "Demo"→"Smith") were added
as reveal pairs, causing partial replacements that corrupted the DOM.
The smart engine sends combined forms ("Ademo Demo"→"John Smith")
which the catch-all already handles. Removed individual name entries
from buildRevealPairs — only emails, usernames, hostnames, phones
are matched individually.
2. Cache invalidated on every ss:config-updated (including settings-only
changes like reveal toggle). Now only invalidates when mappings or
identity actually change.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
If reveal mode was saved as ON in settings, the page loaded with
revealMode=true and prevRevealMode=true. The checkRevealToggle
function only fires on transitions (off→on or on→off), so the
reveal interval was never started. Added initialization check
that starts the reveal interval immediately if revealMode is
already true at page load.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
AMO expects { required: false } not { collect_user_data: false }.
Bumped strict_min_version to 140.0 (when data_collection_permissions
was introduced). Version 0.9.8.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
When at-rest encryption is enabled, storage.onChanged fires with
encrypted blobs for ss_settings. The injector was passing this
encrypted blob directly as settings to the page world content script,
overwriting real settings with { _ssLocalEncrypted: true, data: ... }.
This broke reveal mode, highlights, and any setting toggle because
the content script's settings object became the encrypted blob.
Fix: skip encrypted settings blobs in injector.js (same check already
existed for mappings and identity). The background's settings:updated
message already sends decrypted settings correctly.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
MIT is true open source (OSI-approved) and provides the same liability
protection through its warranty disclaimer. The strengthened disclaimer
covering silent third-party failures, regulatory non-compliance, and
user verification responsibility is retained in the LICENSE file.
BSL restricted commercial use but didn't add legal protection — the
liability limitation is what protects against lawsuits, and that works
the same under MIT.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Bug 1: popup.html had duplicate id="optAutoRedact" on both the
Auto Redact toggle and Auto-redact Detected PII toggle. The second
overwrote the first, making the Auto Redact setting uncontrollable.
Fixed by giving the second toggle id="optAutoRedactDetected".
Bug 2: injector.js hardcoded activity log trim to 100, ignoring the
user's maxLogEntries setting. Now reads the setting from storage.
Added test-suite.html with 35+ tests covering storage, encryption,
sync (encryption-mandatory flows), auto-redact (built-in + custom
patterns), substitution engine, smart patterns, and auto-detect.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
PII (Personally Identifiable Information) is the correct standard term.
Renamed all instances — comments, UI labels, variable names, function
names (autoDetectPPI → autoDetectPII, scanInputForPPI → scanInputForPII,
ppiWarnings → piiWarnings), CSS comments, README, and options page.
Added Ko-fi donation section to README and Options footer. Tone: no
obligation, no warranty, no influence on updates — just appreciation.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Commercial use is no longer permitted under the license. The BSL-1.1
still converts to MIT on March 26, 2030. All disclaimer and liability
language retained — applies to all users regardless.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
- LICENSE: expanded warranty disclaimer covering silent failures from
third-party changes, coverage gaps, regulatory non-compliance, and
commercial licensee expectations. Explicit limitation of liability
for privacy breaches, identity theft, and regulatory penalties.
- PRIVACY.md: added limitations section covering third-party changes,
coverage gaps, user responsibility, and compliance disclaimer.
- README.md: detailed disclaimer with specific scenarios — site API
changes, coverage gaps, user verification responsibility, and
commercial license scope.
- Popup: expanded footer warning about third-party changes and user
responsibility.
- Options page: added footer disclaimer with LICENSE link, updated
version to 0.9.0.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Users can now define custom regex patterns for proprietary token formats,
internal URLs with keys, or any secret the built-in scanner doesn't cover.
Patterns are added/toggled/removed from the Options page and apply to both
the live interception (content.js) and the Test tab (popup.js).
Renamed all user-facing "Secret scanning" labels to "Auto Redact" across
popup and options. Internal variable names (secretScanning, SecretScanner)
kept for backwards compatibility with stored settings.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Complete rewrite with safety features:
- Version profiles: groups files by version, only updates the current
version (ignores unrelated X.Y.Z strings in the project)
- Preview: shows exact line-by-line diff before applying changes
- Confirmation: asks y/N before modifying files (--yes to skip)
- Undo: saves rollback info, ./bump-version.sh undo to revert
- --help: full usage documentation with examples
- Only matches version DECLARATIONS (requires keyword context like
"version":, version=, VERSION=, v prefix) — won't match random
numbers like dates, IPs, or port numbers
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Agnostic version bump tool that finds all version strings in the
project and updates them together.
Usage:
./bump-version.sh # interactive menu
./bump-version.sh patch # 0.9.0 → 0.9.1
./bump-version.sh minor # 0.9.0 → 0.10.0
./bump-version.sh major # 0.9.0 → 1.0.0
./bump-version.sh 1.2.3 # set to specific version
Finds versions in JSON files ("version": "X.Y.Z") and HTML/JS
files (vX.Y.Z). Excludes node_modules and dist directories.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Added copilot.microsoft.com to host_permissions, content_scripts
matches, and BUILTIN_URL_PATTERNS in both Chrome and Firefox manifests
plus the service worker.
Updated README:
- Added Copilot to supported services table
- Added Edge and Brave to browser list
- Added note about desktop apps (can't intercept, use web version)
- Removed old duplicate browser note
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
'Secret Scanner' described what it looks for. 'Auto-redact' describes
what it does — clearer for users. Renamed in popup, options page,
org section, and README. Internal code (secret-scanner.js) unchanged
to avoid breaking references.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Removing the footer <a id="btnOptions"> made $('#btnOptions') return
null, causing addEventListener to throw. This killed the rest of
initUnlockedUI(), preventing the Options tab and all subsequent
handlers from being wired up.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Outis