DevUnlock Chrome extension security report

Keep Chrome DevTools open without being signed out. Some sites ship an anti-debugging script that polls, twice a second, for an open DevTools window. When it finds one, it ends your session and drops you back on the sign-in page — in practice within about 300 ms, before you can read a single network request. DevTools Unlock stops that one timer, so the page behaves like any other site while you inspect it. WHY IT DOESN'T LEAVE YOU WITH A BLANK PAGE The usual way to defeat a DevTools detector is to overwrite the native functions it relies on — Function, eval, fetch, document.cookie, window.outerWidth. On a site that guards itself that backfires: the page integrity-checks those functions, and when it sees them rewritten it halts rendering, leaving an empty screen. This extension takes the opposite approach. • It wraps exactly one API: window.setInterval. The detection heartbeat is an interval, and wrapping setInterval is the only way to observe the timer id it returns — which is what makes it possible to stop that timer and nothing else. The wrapper preserves name, length and toString, and the page does not integrity-check setInterval. • It never touches Function, eval, fetch, document.cookie or the window size properties. • It clears intervals only. setInterval and setTimeout share one id space in the browser, so sweeping ids blindly also kills the timeouts the site needs to boot its UI — that is what produces a blank sign-in page or profile page. The sweep only clears ids it saw registered as intervals. WHAT TO EXPECT • Install it, reload the tab, and open the console: you'll see [devtools-unlock] fast sweep loop — cadence 120ms. • There is no popup, no options page and nothing to configure. • Side effect, stated plainly: while a tab on the covered site is open, that page's own recurring setInterval polling stays stopped too. Ordinary browsing and rendering are unaffected; timeouts, animations and network requests all continue normally. • If the detector also flags a docked DevTools window through the window size difference, drag DevTools out into a separate window. This extension deliberately does not fake window dimensions. DIAGNOSTIC LOG If a sign-out still slips through, a passive log records what the page looked like at the moment it happened — event type, URL, whether DevTools was docked, and elapsed time. It is a 200-entry ring buffer in your own browser's localStorage. It is never uploaded anywhere. Read it with JSON.parse(localStorage.__du_log), print it with Ctrl+Alt+Shift+L, or erase it by adding #du-clear-log to the URL and reloading. PRIVACY No data is collected, transmitted or shared. The extension declares no Chrome permissions, makes no network requests of its own, runs no remote code, and can only reach the single site declared in its manifest. It is a single 12 KB script. Full privacy policy: walle-go.github.io/devtools-unlock-privacy NOT FOR AUTOMATION PROFILES Do not enable this extension in a browser profile used for automated polling (fingerprint browsers, RPA runners). Stopping interval timers can interrupt that automation. Use a clean, separate Chrome profile for debugging.