FURSOY Vault Chrome extension security report

Malware doesn't need your password. It doesn't need your 2FA code either. It copies the session cookies sitting in your browser and logs in as you. That's how a large share of account takeovers actually happen now — no password guessing, no phishing page, just a file quietly copied off your PC. FURSOY Vault takes those cookies out of your browser when you're not using them, and keeps them in an encrypted vault sealed by the security chip in your own machine. For Chromium browsers — Chrome, Edge, Brave and the rest — on Windows 10/11 or Linux. Needs a one-time companion app. Full requirements are at the bottom; please check them before installing. HOW IT WORKS 1. Pick the accounts that would hurt to lose — your mail, your bank, your work login. 2. When you're not using them, their cookies leave the browser and go into an encrypted vault on your own PC. 3. When you come back, your face, fingerprint or PIN brings that session back. Just that one — unlocking your bank never touches your mail. Close the tab, walk away, or lock your PC, and it locks itself again. WHILE LOCKED, THERE IS NOTHING TO TAKE This is the whole point. Infostealer malware goes after the browser's cookie database, and cookie theft remains one of the most reliable ways into an account that a password and 2FA would otherwise protect. For your protected sites, that attack comes up empty — those cookies are not in the browser at all. They sit in a vault that opens only for you. WHO THIS IS FOR * Anyone who stays permanently logged into email, banking or work accounts * Developers and admins whose browser sessions reach production systems * Anyone who has watched a session hijacking happen and would rather not see it again YOUR DATA STAYS YOURS There is no account to create and no server to sign in to. The vault, your list of sites, and the key that opens it never leave your computer. No analytics, no telemetry, no advertising. The extension only asks for access to the sites you add yourself — nothing else. HONEST ABOUT WHAT THIS IS NOT FURSOY Vault shortens how long your sessions sit exposed. It is not a magic shield. It cannot save you from malware that already controls your computer account — such an attacker can simply wait for you to unlock a session. It does not cover passwords, passkeys, localStorage, or your browsing history. The complete threat model is published in the repository; read it before deciding whether this fits your situation. WHAT YOU NEED * A Chromium browser: Chrome, Edge, Brave, Vivaldi or similar. Install from the Chrome Web Store and it works in all of them. * Windows 10/11 or Linux, 64-bit. * A PC with a TPM 2.0 security chip — most machines from the last several years have one. * On Windows: a face, fingerprint or PIN set up on your account (Settings > Accounts > Sign-in options). On Linux: you choose a PIN during setup, and the TPM holds it. * The companion app, installed once. The companion app is not yet code-signed, so Windows may show an "Unknown publisher" warning during setup. Every release ships with SHA-256 checksums so you can verify what you installed. AFTER YOU INSTALL The extension walks you through installing the companion app and protecting your first site. It takes a couple of minutes. OPEN SOURCE Every line is public under GPL-3.0. You don't have to take anyone's word for any of this — read the code: github.com/FURSOY/fursoy-vault