Shows a red warning banner at the top of the popup when no identity,
email, username, or explicit mappings are configured. The status dot
turns orange (instead of green) to indicate the extension is active
but not protecting anything yet. Banner disappears as soon as the
user saves their identity.
Prevents users from thinking they're protected when nothing has
been configured.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Adds a secret scanning layer that runs after identity/explicit
substitutions. Catches secrets the user didn't configure:
- API keys: OpenAI (sk-), Anthropic (sk-ant-), Google (AIza),
AWS (AKIA), GitHub (ghp_), GitLab (glpat-), Slack (xox),
Stripe (sk_live/test), SendGrid (SG.)
- Auth: Bearer tokens, key=value assignments (password=, secret=,
api_key=, token=), private key blocks (-----BEGIN PRIVATE KEY-----)
- Connection strings: mongodb://, postgres://, mysql:// with creds
- PII: SSN (xxx-xx-xxxx), credit card numbers (Visa/MC/Amex/Discover)
Redacted values shown in red in the Test tab. Secrets are truncated
in the activity log (first 8 chars + "...") to avoid logging the
full secret. Enabled by default, toggle in Options.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Users will stop checking once they trust the tool. Be upfront that
it can miss PPI in images, file uploads, unusual name variations,
or unconfigured data. Yellow warning box in the popup footer.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Replace URL-pattern and body-shape matching with universal approach:
Outbound (substitution):
- Hooks ALL POST/PUT/PATCH fetch and XHR requests, not just known
API endpoints. Skips static assets and analytics.
- Deep-walks any JSON structure recursively to find and substitute
all string values. Skips metadata keys (model, id, token, etc.).
- Falls back to raw string substitution for non-JSON bodies.
Inbound (reveal):
- Walks ALL text nodes in document.body, not just specific CSS
selectors. Skips SCRIPT, STYLE, INPUT, TEXTAREA tags.
- Handles streaming by observing characterData mutations globally.
This makes Silent Send survive any API restructuring — the only
thing that could break it is a site encrypting request bodies in
JS before fetch, which would also break their own dev tools.
Performance: reveal pairs are cached and only rebuilt on config
change. Deep walk skips known non-content keys to avoid touching
auth tokens or request metadata.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Reveal mode (eye icon) now works as intended:
- Toggle ON: all existing responses on the page get fake→real
substitution applied immediately (paths, names, emails, etc.)
- Streaming responses are revealed in real-time as they arrive
- Toggle OFF: original text is restored from saved state
- Covers code blocks, artifacts, pre tags, and all response
containers across all supported services
- Blue floating badge shows "Reveal Mode — showing real data"
when active so user knows what they're seeing
The workflow is now: type /home/jsmith/... → Claude sees
/home/ademo/... → Claude responds with /home/ademo/... →
reveal mode shows /home/jsmith/... → user copies real path.
Also adds privacy note in popup footer: data stays in local
browser storage, no servers, no tracking, no analytics.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Test tab now has two modes:
- Strip (real → fake): paste text with real data, see what gets sent
- Reveal (fake → real): paste AI output with fake data, get back
real data with a "Copy to Clipboard" button
Also fixes:
- content.js smartSubstitute bailing when identity.enabled was
undefined (defaulted enabled to all-true instead of returning)
- Test tab now reloads identity from storage on tab switch so
changes saved in the Identity tab take effect immediately
- Shows yellow warning when identity fields are missing
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
- Add custom domain support in Options page so users can add
self-hosted AI services (e.g. https://ai.myserver.com)
- Background worker dynamically injects content scripts on
custom domains using scripting.executeScript
- Add optional_host_permissions so Chrome can grant per-domain access
- Rewrite README: add clone step to Firefox instructions, clarify
what "credentials" means in step 3, add Windows commands alongside
Mac/Linux for every terminal step
- Bump version to 0.2.0
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Extend Silent Send to intercept API requests on all major AI chat
services. Each service has different API shapes:
- ChatGPT: /backend-api/conversation with content.parts arrays
- Grok: GraphQL + /2/grok/add_response with message field
- Gemini: form-encoded f.req with nested arrays (+ generateContent)
- OpenWebUI: /api/chat and /ollama/api/chat (self-hosted)
All services share the same substitution pipeline. Manifests updated
for both Chrome and Firefox with host_permissions for all domains.
OpenWebUI supported via localhost/127.0.0.1 for self-hosted instances.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
jsmith@macbook-pro now becomes ademo@mycomputer when both username
and hostname are configured in the Identity tab. Hostnames are also
caught standalone (e.g. just "macbook-pro" in text).
Also rewrites README with detailed step-by-step Mozilla API key
setup instructions for Firefox signing.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Instead of requiring explicit mappings for every variation, users
now configure their identity once (Identity tab) and Silent Send
auto-catches:
- Emails: any address @gmail, @yahoo, @outlook, etc.
- Names: first/last, full name, reversed, possessives, case variants
- Usernames: user@host, ~user, /home/user, C:\Users\user
- Phones: all common formats ((555) 123-4567, 555.123.4567, etc.)
Smart patterns run before explicit mappings, so explicit rules
can override smart catches when needed.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Add manifest.firefox.json for Firefox MV3 (gecko ID, background
scripts instead of service_worker, options_ui). Introduce
browser-polyfill.js shim so all modules use whichever API is
available (browser.* or chrome.*). Add build.sh to target
chrome, firefox, or both.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Chrome Manifest V3 extension that intercepts personal data and
substitutes it with user-defined replacements before sending to
Claude.ai. Hooks fetch() in the page's main world to catch API
requests, with bidirectional substitution (real→fake on send,
fake→real on display via reveal mode).
Includes popup UI with mapping management, live test/diff view,
activity log with badge count, options page with import/export,
and Shadow DOM traversal for Claude.ai compatibility.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Claude