If reveal mode was saved as ON in settings, the page loaded with
revealMode=true and prevRevealMode=true. The checkRevealToggle
function only fires on transitions (off→on or on→off), so the
reveal interval was never started. Added initialization check
that starts the reveal interval immediately if revealMode is
already true at page load.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
AMO expects { required: false } not { collect_user_data: false }.
Bumped strict_min_version to 140.0 (when data_collection_permissions
was introduced). Version 0.9.8.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
When at-rest encryption is enabled, storage.onChanged fires with
encrypted blobs for ss_settings. The injector was passing this
encrypted blob directly as settings to the page world content script,
overwriting real settings with { _ssLocalEncrypted: true, data: ... }.
This broke reveal mode, highlights, and any setting toggle because
the content script's settings object became the encrypted blob.
Fix: skip encrypted settings blobs in injector.js (same check already
existed for mappings and identity). The background's settings:updated
message already sends decrypted settings correctly.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
MIT is true open source (OSI-approved) and provides the same liability
protection through its warranty disclaimer. The strengthened disclaimer
covering silent third-party failures, regulatory non-compliance, and
user verification responsibility is retained in the LICENSE file.
BSL restricted commercial use but didn't add legal protection — the
liability limitation is what protects against lawsuits, and that works
the same under MIT.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Bug 1: popup.html had duplicate id="optAutoRedact" on both the
Auto Redact toggle and Auto-redact Detected PII toggle. The second
overwrote the first, making the Auto Redact setting uncontrollable.
Fixed by giving the second toggle id="optAutoRedactDetected".
Bug 2: injector.js hardcoded activity log trim to 100, ignoring the
user's maxLogEntries setting. Now reads the setting from storage.
Added test-suite.html with 35+ tests covering storage, encryption,
sync (encryption-mandatory flows), auto-redact (built-in + custom
patterns), substitution engine, smart patterns, and auto-detect.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
PII (Personally Identifiable Information) is the correct standard term.
Renamed all instances — comments, UI labels, variable names, function
names (autoDetectPPI → autoDetectPII, scanInputForPPI → scanInputForPII,
ppiWarnings → piiWarnings), CSS comments, README, and options page.
Added Ko-fi donation section to README and Options footer. Tone: no
obligation, no warranty, no influence on updates — just appreciation.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Commercial use is no longer permitted under the license. The BSL-1.1
still converts to MIT on March 26, 2030. All disclaimer and liability
language retained — applies to all users regardless.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
- LICENSE: expanded warranty disclaimer covering silent failures from
third-party changes, coverage gaps, regulatory non-compliance, and
commercial licensee expectations. Explicit limitation of liability
for privacy breaches, identity theft, and regulatory penalties.
- PRIVACY.md: added limitations section covering third-party changes,
coverage gaps, user responsibility, and compliance disclaimer.
- README.md: detailed disclaimer with specific scenarios — site API
changes, coverage gaps, user verification responsibility, and
commercial license scope.
- Popup: expanded footer warning about third-party changes and user
responsibility.
- Options page: added footer disclaimer with LICENSE link, updated
version to 0.9.0.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Users can now define custom regex patterns for proprietary token formats,
internal URLs with keys, or any secret the built-in scanner doesn't cover.
Patterns are added/toggled/removed from the Options page and apply to both
the live interception (content.js) and the Test tab (popup.js).
Renamed all user-facing "Secret scanning" labels to "Auto Redact" across
popup and options. Internal variable names (secretScanning, SecretScanner)
kept for backwards compatibility with stored settings.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
- Edit domains inline (pencil icon, saves on Enter)
- Suggested domains: clickable chips for popular AI/dev/collab sites
- Bulk add: paste multiple domains at once (one per line or comma-separated)
- Popup domain management: add/remove/suggestions directly from the popup
- Permission revoke on removal + suggested list updates dynamically
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
New AI sites: Perplexity, Copilot, DeepSeek, HuggingChat, Poe
Developer/support: GitHub, GitLab, Reddit (www + old), Stack Overflow, Pastebin
The existing interception is service-agnostic — it scans all JSON strings
in POST/PUT/PATCH requests through the 4-stage substitution pipeline.
No site-specific handling needed; all sites use the same method.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Replace tab-load-only injection with scripting.registerContentScripts()
so custom domains inject at document_start (like built-in sites) and
persist across service worker restarts. Scripts re-register automatically
when domains change. Removed domains now revoke browser permissions.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Sync operations (browser sync, Gist, custom URL, sync code) now refuse to
operate without encryption enabled. Disabling encryption also turns off all
active sync channels. Activity log cap reduced from 200 to 100 entries for
both storage and display.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Updated "How to verify it's working" with step-by-step instructions
for each browser showing exactly where to click:
- Firefox: F12 → Network → POST events → Request tab → expand JSON
- Chrome: F12 → Network → POST chat/events → Payload tab
- Safari: Cmd+Opt+I → Network → POST → Request
Includes what to look for (replaced data should be there, real data
should not) and what to do if verification fails.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
README changes:
- Added step-by-step "How to verify it's working" section with 6
methods, including Network tab inspection to prove real data never
reaches the AI
- Removed App Store distribution steps (internal, not user-facing)
- Rewrote "What Silent Send can't catch" — updated file uploads line
(we now scan them), clearer language
- Replaced "Legal" section with concise user-facing disclaimer —
removed internal litigation notes that read like developer-to-
developer instead of developer-to-user
- Shortened license section
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Added:
- Safari installation section (full guide: build, test without
Apple Developer account via Allow Unsigned Extensions, App Store
distribution steps)
- Document scanning section with format support table
- Concatenated name patterns in smart pattern examples
- Options tab mention in "how to verify" section
- Browser support note (Chrome, Firefox, Safari)
- document-scanner.js and build-safari.sh in architecture section
- Updated service-worker.js and content.js descriptions
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Popup:
- Added 5th "Options" tab with key settings accessible without
opening the full options page: secret scanning, auto-detect PPI,
auto-redact, show highlights, document scan preview
- "Open Full Options Page" button for sync/encryption/org/import
- Settings changes in popup immediately broadcast to content scripts
Safari:
- Added build-safari.sh that uses Apple's safari-web-extension-converter
to generate an Xcode project from the Firefox build
- browser-polyfill.js already handles Safari (uses browser.* like Firefox)
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Fixed safeHTML in all three files — template.content.childNodes and
doc.body.childNodes are live NodeLists that shrink as nodes are moved.
Using Array.from() to create a static copy before spreading into
replaceChildren().
Expanded proper noun common words filter with ~500 additional verbs,
nouns, and adjectives (generate, design, manage, process, account,
button, dashboard, etc.) to prevent false PPI flags on titles,
headings, and UI button labels.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Massively expanded the common words filter — added ~500 common verbs,
nouns, and adjectives that frequently appear capitalized in titles,
headings, UI buttons, and instructions. 'Generate Design', 'Create
Account', 'Search Filter', etc. are no longer flagged as PPI.
Updated both content.js and auto-detect.js with the same word list.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
sessionSubstitutions stored keys as toLowerCase() for lookup, but the
lowercase key was also used as the substitute value when building
reveal pairs. This caused unrevealText to replace "John Smith" with
"ademo demo" instead of "Ademo Demo".
Fixed by storing both the original-case substitute and the original
real value in sessionSubstitutions. The lowercase key is still used
for lookup, but the preserved-case value is used for reveal pairs.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
When reveal mode was turned OFF, text stayed showing real data
(e.g. "John Smith") instead of reverting to the AI's actual text
("Ademo Demo"). The unreveal function relied on a WeakMap of
original text nodes which lost entries when DOM nodes were replaced
during streaming responses.
Fixed by replacing WeakMap-based restore with active reverse
replacement: unrevealText() replaces real→substitute (the opposite
direction of revealText). This is reliable regardless of DOM changes.
Removed originalTexts WeakMap entirely.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
1. Removed data_collection_permissions from Firefox manifest — it
requires Firefox 140+ but we target 128+. Only produces a warning
when missing, not a blocking error.
2. Fixed JS syntax error in content.js line 450 — two extra closing
braces from a bad merge in the proper noun detection function
caused a parse error that blocked Mozilla validation.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Replaced all 31 innerHTML assignments across popup.js (12),
options.js (17), and content.js (3) to pass Mozilla AMO linter.
Each file gets a safeHTML(el, html) helper:
- popup.js/options.js: DOMParser-based (extension page context)
- content.js: <template> element pattern (page world context)
Empty innerHTML clears replaced with el.replaceChildren().
innerHTML += replaced with createElement + safeHTML + appendChild.
All event listener bindings after HTML rebuilds remain functional
since safeHTML uses replaceChildren() which populates DOM
synchronously before querySelectorAll + addEventListener calls.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Required for Firefox Add-ons (AMO) public listing submission.
Documents that all processing is 100% local, no data collection,
no servers, no analytics. Explains each permission and all
optional network requests (sync, org policy).
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Set Chrome, Firefox, and package.json all to version 2.0.0
(major bump reflecting encrypted storage, document scanning,
org/team features, sync improvements).
Sign script rewritten:
- Tries current version first instead of always bumping
- Only bumps on "version already exists" errors
- Handles rate limiting by parsing throttle duration from error
and waiting the exact time (not blindly retrying)
- Only updates source files on successful signing (not before)
- Reduced max attempts to 5 (with proper backoff, shouldn't need more)
- Commits version bump only after successful sign
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
The X icon looked like a dismiss/close button (temporary). Changed to
a small 'IGNORE' text link that clearly communicates the action is
permanent — the value will never be flagged again.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Claude