Bug fixes:
- Date (possible DOB) pattern now requires context words (born, birthday,
dob, etc.) before firing — prevents spurious warnings on page-load API
calls that happen to contain ISO dates in conversation history.
- Highlight regex now uses word boundaries (\b) so short substitute values
(e.g. "aud") no longer match inside unrelated words like "Claude".
- Both TreeWalkers in content.js now skip the extension's own UI elements
(.ss-autodetect-warning, .ss-presend-warning, .ss-reveal-badge) to
prevent the highlight API from marking text in the extension's banners.
Settings sync:
- New src/lib/sync.js: exportSyncCode / importSyncCode (base64 JSON) for
manual copy-paste across any browser combination. Newest lastModified
timestamp wins; force flag available to override.
- browser.storage.sync support: when "Browser account sync" is enabled the
extension automatically pushes/pulls via Firefox Sync or Chrome account,
chunked to stay within per-item quota limits.
- storage.js now writes ss_lastModified on every save so conflict resolution
has an accurate timestamp.
- service-worker.js listens for both local and sync storage changes to keep
all copies in sync.
- New "Sync Between Browsers" section in options.html with Generate/Copy/
Import Sync Code UI and the browser sync toggle.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Detected PPI is now auto-redacted in the fetch hook using
RFC/standard reserved values — not just warned about:
- IPs → 192.0.2.1 (RFC 5737 TEST-NET-1, never routed)
- MACs → 00:00:00:00:00:00
- Addresses → 123 Example Street, Anytown, ST 00000
- GPS → 0.000000,0.000000 (Gulf of Guinea)
- Dates → 01/01/1970 (Unix epoch)
- EINs → 00-0000000 (impossible prefix)
- Paths → /home/user
- Git → example org
These are obviously fake and guaranteed not to be real data,
unlike random values which could be confused with actual PPI.
New Options toggle: "Auto-redact detected PPI on send" (on by
default). When on, PPI is caught in the fetch hook even if the
user hits Enter immediately after pasting. Warning banner now
says "Auto-redacted with standard placeholders" instead of
"These were sent as-is."
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Like spellcheck for privacy. Scans text as you type and paste
into chat inputs (debounced 800ms). Shows a dark floating warning
panel listing detected PPI BEFORE you hit Enter.
Each detected item has a green [+] button that instantly:
1. Generates a plausible fake value (random IP, fake address, etc.)
2. Adds it as a mapping to storage
3. Shows a checkmark to confirm
The warning disappears when you clear the text or when all
detected items have been addressed.
Three new Options toggles:
- Auto-detect unconfigured PPI (on by default)
- Offer to auto-add detected PPI (on by default)
Also adds a storage bridge (postMessage) so the page-world
content script can read/write chrome.storage through the
injector.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Scans outbound messages AFTER all substitutions for personal data
the user forgot to configure:
- Private/public IP addresses (skips 127.0.0.1, 8.8.8.8, etc.)
- MAC addresses
- Street addresses ("123 Main St")
- GPS coordinates
- Dates (possible DOBs)
- EIN/tax IDs
- Home directory paths not caught by smart patterns
- Shell prompts (user@host)
- Git remotes (reveals username/org)
- Environment variable assignments (HOME=, USER=, etc.)
Shows a floating dark warning banner (top-right, auto-dismisses
after 15s) listing each detected item with its type, value, and
hint. Skips values already in the user's identity config.
Also shows PPI warnings in the popup Test tab and adds toggle
in Options to disable auto-detect.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
License: Changed from MIT to BSL 1.1. Free for personal use,
commercial use requires a paid license. Auto-converts to MIT
on March 26, 2030.
Export/Import: Options page now has "Transfer Data" section:
- Export All (plain) — JSON file with all identities, mappings, settings
- Export Encrypted — AES-256-GCM with PBKDF2 password derivation,
saved as .ssbackup file
- Import — handles both plain and encrypted backups, prompts for
password if encrypted
Crypto uses Web Crypto API (browser-native, no dependencies):
100k PBKDF2 iterations, random salt + IV per export.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Storage issue: Chromium/Brave keeps storage.local data even when
an unpacked extension is removed and reloaded. Added "Reset
Everything" button in Options → Danger Zone that clears all data
(double-confirm to prevent accidents).
Reveal mode: Now re-runs revealAllResponses() every 2 seconds
while active to catch streamed content and dynamically loaded
responses. Adds console logging for reveal toggle state changes
to aid debugging. Cleans up interval when reveal mode is turned off.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Interception is now completely inactive until the user configures
at least one identity field or explicit mapping. Before that:
- Icon shows gray (unconfigured)
- No fetch/XHR hooks fire
- First-run banner tells user to set up
Custom domains: clicking "Add Domain" in Options now triggers
the browser's native permission prompt via permissions.request().
No more manual chrome://extensions site access step.
Icon states are now:
- Gray = unconfigured (nothing will happen)
- Black = active and protecting
- Blue = reveal mode on
- Red = manually disabled
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Adds a secret scanning layer that runs after identity/explicit
substitutions. Catches secrets the user didn't configure:
- API keys: OpenAI (sk-), Anthropic (sk-ant-), Google (AIza),
AWS (AKIA), GitHub (ghp_), GitLab (glpat-), Slack (xox),
Stripe (sk_live/test), SendGrid (SG.)
- Auth: Bearer tokens, key=value assignments (password=, secret=,
api_key=, token=), private key blocks (-----BEGIN PRIVATE KEY-----)
- Connection strings: mongodb://, postgres://, mysql:// with creds
- PII: SSN (xxx-xx-xxxx), credit card numbers (Visa/MC/Amex/Discover)
Redacted values shown in red in the Test tab. Secrets are truncated
in the activity log (first 8 chars + "...") to avoid logging the
full secret. Enabled by default, toggle in Options.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
- Add custom domain support in Options page so users can add
self-hosted AI services (e.g. https://ai.myserver.com)
- Background worker dynamically injects content scripts on
custom domains using scripting.executeScript
- Add optional_host_permissions so Chrome can grant per-domain access
- Rewrite README: add clone step to Firefox instructions, clarify
what "credentials" means in step 3, add Windows commands alongside
Mac/Linux for every terminal step
- Bump version to 0.2.0
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Chrome Manifest V3 extension that intercepts personal data and
substitutes it with user-defined replacements before sending to
Claude.ai. Hooks fetch() in the page's main world to catch API
requests, with bidirectional substitution (real→fake on send,
fake→real on display via reveal mode).
Includes popup UI with mapping management, live test/diff view,
activity log with badge count, options page with import/export,
and Shadow DOM traversal for Claude.ai compatibility.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Claude