LeakFence Local Chrome extension security report

Stop secrets before they leak into an AI chat. LeakFence Local runs only on a defined list of AI chat sites, not on the rest of your browsing. It pauses paste and submit actions on those sites, checks the text on your device, and blocks anything that looks like a secret before it's sent. Nothing is scanned in the cloud: there is NO account, NO developer server, and NO telemetry. WHAT IT CATCHES: 1. Common API key and token formats 2. JWTs and private key blocks (PEM-style) 3. Recovery-phrase contexts 4. IBANs and PESEL numbers 5. Any custom value you protect manually: internal tokens, client IDs, or anything else that doesn't match a common pattern PROTECT YOUR OWN SECRETS Add a label and a secret value once, and LeakFence converts it into a local HMAC-SHA-256 fingerprint, keyed by a random, per-install key stored in chrome.storage.local. The plaintext value is never stored: only the fingerprint is kept, and it's used to recognize that exact secret if it's ever about to be pasted into a chat. WHEN SOMETHING IS CAUGHT A paste or submit that matches a known pattern or a protected secret is paused with a clear prompt. From there you can keep it blocked, insert a redacted version with the secret swapped for a placeholder, or clear the field. As an extra layer after a risky secret is found, LeakFence also does a best-effort lock on common exfiltration paths on the page: fetch, XHR, sendBeacon, WebSocket, and form submission, so a blocked secret is less likely to slip out through another channel on the same page. PRIVACY, BY CONSTRUCTION: 1. No remote scanning endpoint: the extension has nowhere to send your data 2. Prompt text is evaluated locally by the content script and background worker 3. Protected secrets are stored as local HMAC fingerprints, never as plaintext 4. Audit entries stay in chrome.storage.local and never include plaintext secrets 5. No prompts, secrets, fingerprints, hashes, or usage analytics are ever uploaded, by anyone, including us 6. Fully open source, so every claim above is verifiable: github.com/X-3306/LeakFence-Extension Available in English and Polish. Questions, bug reports, or feature requests: open an issue on GitHub.