MIT is true open source (OSI-approved) and provides the same liability
protection through its warranty disclaimer. The strengthened disclaimer
covering silent third-party failures, regulatory non-compliance, and
user verification responsibility is retained in the LICENSE file.
BSL restricted commercial use but didn't add legal protection — the
liability limitation is what protects against lawsuits, and that works
the same under MIT.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
PII (Personally Identifiable Information) is the correct standard term.
Renamed all instances — comments, UI labels, variable names, function
names (autoDetectPPI → autoDetectPII, scanInputForPPI → scanInputForPII,
ppiWarnings → piiWarnings), CSS comments, README, and options page.
Added Ko-fi donation section to README and Options footer. Tone: no
obligation, no warranty, no influence on updates — just appreciation.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Commercial use is no longer permitted under the license. The BSL-1.1
still converts to MIT on March 26, 2030. All disclaimer and liability
language retained — applies to all users regardless.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
- LICENSE: expanded warranty disclaimer covering silent failures from
third-party changes, coverage gaps, regulatory non-compliance, and
commercial licensee expectations. Explicit limitation of liability
for privacy breaches, identity theft, and regulatory penalties.
- PRIVACY.md: added limitations section covering third-party changes,
coverage gaps, user responsibility, and compliance disclaimer.
- README.md: detailed disclaimer with specific scenarios — site API
changes, coverage gaps, user verification responsibility, and
commercial license scope.
- Popup: expanded footer warning about third-party changes and user
responsibility.
- Options page: added footer disclaimer with LICENSE link, updated
version to 0.9.0.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Added copilot.microsoft.com to host_permissions, content_scripts
matches, and BUILTIN_URL_PATTERNS in both Chrome and Firefox manifests
plus the service worker.
Updated README:
- Added Copilot to supported services table
- Added Edge and Brave to browser list
- Added note about desktop apps (can't intercept, use web version)
- Removed old duplicate browser note
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
'Secret Scanner' described what it looks for. 'Auto-redact' describes
what it does — clearer for users. Renamed in popup, options page,
org section, and README. Internal code (secret-scanner.js) unchanged
to avoid breaking references.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Reveal mode and highlights were replacing text in sidebars, navigation,
headers, repo names, and other non-chat UI elements. Now skips:
- <nav>, <aside>, <header>, <footer> elements
- Elements with role="navigation", role="banner", role="complementary"
- Elements with class names containing sidebar, nav, menu, header
Added isInNonChatArea() check to all five code paths:
- revealInElement, unrevealInElement, highlightMatches
- MutationObserver addedNodes and characterData handlers
Also:
- Removed footer Options link (redundant with 5th Options tab)
- Updated README: ChatGPT marked as Tested
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Root cause: when importing an encrypted sync code from another device,
_decryptFromSync was replacing the local encryption config (salt) with
the source device's salt. This caused:
1. Local key cache derived from wrong salt
2. Local data (encrypted with local salt) became unreadable
3. _applyData tried to write with the wrong key
Fixed with a complete refactor of cross-device decryption:
- authenticateForSync() derives a TEMPORARY key using the source salt
- Temporary key stored separately as 'tempSyncKey' in IndexedDB
- Local encryption config and cached key are NEVER modified
- After decryption, _applyData writes via _writeSecure using the
LOCAL key (which uses the local salt)
- _handleDecryptedMeta extracted for code reuse
Also:
- Options.js auth handler detects pending sync import and routes to
authenticateForSync instead of regular authenticate
- After auth success, automatically retries the import
- README updated: imported passwords are protected (dots in UI,
vault password to reveal, AES-256 encrypted at rest)
- Bumped to v2.0.9
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Shows which sync methods work in which browsers:
- Sync Code, GitHub Gist, Custom URL: all browsers
- Browser account sync: Chrome and Firefox only
- Auto-Sync Folder: Chrome only (File System Access API)
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Proper noun detection (flagging capitalized phrases like "Getting
Started", "Generate Design", "Introduction Getting Started") now
disabled by default. Enable via popup → Options tab → Detect proper
nouns.
The pattern-based detection (IPs, emails, API keys, addresses, paths,
etc.) remains always-on and reliable. The capitalized phrase heuristic
was producing too many false positives on normal UI phrases, headings,
and instructions — adding words to the filter was a losing game.
Added detectProperNouns toggle to popup Options tab.
Updated README to note it's opt-in.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Updated "How to verify it's working" with step-by-step instructions
for each browser showing exactly where to click:
- Firefox: F12 → Network → POST events → Request tab → expand JSON
- Chrome: F12 → Network → POST chat/events → Payload tab
- Safari: Cmd+Opt+I → Network → POST → Request
Includes what to look for (replaced data should be there, real data
should not) and what to do if verification fails.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
README changes:
- Added step-by-step "How to verify it's working" section with 6
methods, including Network tab inspection to prove real data never
reaches the AI
- Removed App Store distribution steps (internal, not user-facing)
- Rewrote "What Silent Send can't catch" — updated file uploads line
(we now scan them), clearer language
- Replaced "Legal" section with concise user-facing disclaimer —
removed internal litigation notes that read like developer-to-
developer instead of developer-to-user
- Shortened license section
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Added:
- Safari installation section (full guide: build, test without
Apple Developer account via Allow Unsigned Extensions, App Store
distribution steps)
- Document scanning section with format support table
- Concatenated name patterns in smart pattern examples
- Options tab mention in "how to verify" section
- Browser support note (Chrome, Firefox, Safari)
- document-scanner.js and build-safari.sh in architecture section
- Updated service-worker.js and content.js descriptions
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Import parser:
- Passwords now imported from Chrome/Firefox/Bitwarden/1Password CSVs
as exact-match auto-redacted mappings (→ [REDACTED-PASSWORD-N])
- Catches passwords in any context, not just key=value patterns
Proper noun heuristic:
- Auto-detect scanner now catches capitalized words mid-sentence as
potential names, company names, or project names
- Filters against 200+ common English words, programming terms, days,
months to reduce false positives
- Added to both content.js (page world) and auto-detect.js (popup)
README:
- Documented proper noun detection with examples
- Documented bulk import with all supported formats
- Added Sync features section (auto sync, conflict resolution,
version history, connected devices)
- Added Organization/Team section with policy format
- Added tamper protection documentation
- Added Legal section with liability analysis
- Updated architecture with all new modules
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Settings now encrypted at rest alongside identity, mappings, and log.
Custom domains reveal which private AI services the user accesses,
which is arguably PPI. Only the encryption salt and verification blob
remain plaintext (needed for key derivation bootstrap).
Updated README with comprehensive security documentation:
- At-rest encryption details (what's encrypted, what's not, why)
- Vault unlock flow explanation
- Authentication options table (password, TOTP, WebAuthn)
- Cross-device sync encryption flow
- Smart reveal behavior
- LOCK badge state in icon colors table
- Updated architecture section with crypto/sync modules
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
License: Changed from MIT to BSL 1.1. Free for personal use,
commercial use requires a paid license. Auto-converts to MIT
on March 26, 2030.
Export/Import: Options page now has "Transfer Data" section:
- Export All (plain) — JSON file with all identities, mappings, settings
- Export Encrypted — AES-256-GCM with PBKDF2 password derivation,
saved as .ssbackup file
- Import — handles both plain and encrypted backups, prompts for
password if encrypted
Crypto uses Web Crypto API (browser-native, no dependencies):
100k PBKDF2 iterations, random salt + IV per export.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
~85-90% correctness for configured data. Lists specific things
that leak: images, file uploads, base64, short names, names
inside other words, unconfigured data, non-standard secrets.
"Think of it like a spell checker for privacy — it catches most
things, but you wouldn't send a legal document without proofreading."
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Add LICENSE file (MIT). Explain in README that reveal mode is a
local display change only — the AI never received the real data.
Reveal exists so users can copy paths/commands from AI responses
and paste them directly into their terminal without manually
translating fake values back to real ones.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Identity fields now support multiple entries per type:
- Add unlimited names (first, last, middle, nickname), emails,
usernames, hostnames, and phone numbers per profile
- "+ Add" button on each section, "x" to remove rows
- Names have a type selector (1st/Last/Mid/Nick)
README now includes:
- First-time setup walkthrough (step by step)
- Icon color legend (gray/black/blue/red)
- Keyboard shortcuts table
- Note that extension does nothing until configured
Also bumps version to 0.3.0 for Firefox re-signing.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
The previous approach (source .env && npm run sign:firefox) failed
because npm subshells don't inherit env vars consistently, and
quoted values in .env weren't being stripped.
New approach: sign-firefox.sh reads .env itself, strips quotes,
and passes --api-key/--api-secret directly to web-ext sign.
Also renames web-ext-config.js → web-ext-config.cjs to fix the
deprecation warning, and bumps package.json version to 0.2.0.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
- Add custom domain support in Options page so users can add
self-hosted AI services (e.g. https://ai.myserver.com)
- Background worker dynamically injects content scripts on
custom domains using scripting.executeScript
- Add optional_host_permissions so Chrome can grant per-domain access
- Rewrite README: add clone step to Firefox instructions, clarify
what "credentials" means in step 3, add Windows commands alongside
Mac/Linux for every terminal step
- Bump version to 0.2.0
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Add clone instructions, prerequisites, and detailed step-by-step
Firefox signing walkthrough. Mark Claude as tested, all other
services (ChatGPT, Grok, Gemini, OpenWebUI) as untested.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Extend Silent Send to intercept API requests on all major AI chat
services. Each service has different API shapes:
- ChatGPT: /backend-api/conversation with content.parts arrays
- Grok: GraphQL + /2/grok/add_response with message field
- Gemini: form-encoded f.req with nested arrays (+ generateContent)
- OpenWebUI: /api/chat and /ollama/api/chat (self-hosted)
All services share the same substitution pipeline. Manifests updated
for both Chrome and Firefox with host_permissions for all domains.
OpenWebUI supported via localhost/127.0.0.1 for self-hosted instances.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
jsmith@macbook-pro now becomes ademo@mycomputer when both username
and hostname are configured in the Identity tab. Hostnames are also
caught standalone (e.g. just "macbook-pro" in text).
Also rewrites README with detailed step-by-step Mozilla API key
setup instructions for Firefox signing.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Add package.json with web-ext dev dependency and npm scripts for
building, linting, signing, and running the Firefox extension.
Signing produces a self-hosted .xpi that persists across restarts
without needing the Mozilla store.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Add manifest.firefox.json for Firefox MV3 (gecko ID, background
scripts instead of service_worker, options_ui). Introduce
browser-polyfill.js shim so all modules use whichever API is
available (browser.* or chrome.*). Add build.sh to target
chrome, firefox, or both.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Chrome Manifest V3 extension that intercepts personal data and
substitutes it with user-defined replacements before sending to
Claude.ai. Hooks fetch() in the page's main world to catch API
requests, with bidirectional substitution (real→fake on send,
fake→real on display via reveal mode).
Includes popup UI with mapping management, live test/diff view,
activity log with badge count, options page with import/export,
and Shadow DOM traversal for Claude.ai compatibility.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Claude