Obfusca Chrome extension security report

Detect and protect sensitive data before you send it to AI — SSNs, API keys, credentials, and more. Obfusca scans messages and files you send to AI platforms, catches sensitive data before it leaves your browser, and lets you replace it with safe alternatives — automatically. Works across most popular AI chat assistants and productivity platforms. HOW IT WORKS When you type a message or attach a file, Obfusca intercepts the submission before it reaches the AI platform. It scans for sensitive data using pattern matching with validators (like Luhn checksum for credit cards and format validation for SSNs). If anything is found, a popup shows you exactly what was detected with a live preview of the protected version. You choose what to do — replace it, edit your message, or send it as-is. Nothing is sent until you decide. WHAT IT DETECTS Built-in detection patterns with validation: - Social Security Numbers — with format validation (rejects invalid area numbers and group codes) - Credit Card Numbers — Visa, Mastercard, Amex, Discover with Luhn checksum verification - Cloud access keys and secret keys — with prefix and format validation - API Keys — sk- prefixed keys, generic API keys, bearer tokens - Private Keys — PEM format (RSA and standard) - Source control access tokens - Messaging platform tokens - Email Addresses Semantic Detection (Individual, Team, and Enterprise plans): Go beyond pattern matching. Define detection rules in plain English like "flag any dollar amounts related to legal settlements" or "detect internal project codenames." Semantic detection reads context — it knows that "John" alone is fine but "John Smith earns $200K" is sensitive. It catches data that no regex ever could: spoken-out SSNs ("my social is one two three..."), partial card info ("card ending 4242, CVV 123"), confidential business metrics, health information, and proprietary strategy details. Industry presets for technology, finance, healthcare, and general use get you started with one click. Custom Patterns: Create your own detection rules using regex or keyword lists. Eight pre-built templates included for common enterprise scenarios like internal URLs, project codenames, customer IDs, employee IDs, and proprietary terms. THREE WAYS TO PROTECT YOUR DATA - Mask — Format-preserving X-masks that keep structure visible. "$1.2M" becomes "$X.XX", "John Smith" becomes "Xxxx Xxxxx". - Smart Replace — Realistic dummy values that preserve context. Credit cards keep the right network prefix, names keep title formatting ("Dr. Smith" becomes "Dr. Doe"), phone numbers keep country format. - Custom — Type your own replacement text for any detection. Quick-select options like [REDACTED], [CONFIDENTIAL], [PRIVATE], or anything you want. You can mix and match modes per detection — mask the SSN but smart-replace the name in the same message. FILE SCANNING Obfusca scans documents, spreadsheets, source code, configuration files, and text files before they are uploaded. It supports common office formats, structured data files, and major programming languages. When sensitive data is found in a file, you can download a protected copy or automatically upload the sanitized version to the chat. SUPPORTED PLATFORMS Obfusca works on leading browser-based AI assistants and productivity tools. POLICY SYSTEM Set rules for how each type of sensitive data should be handled: - Block — Prevent submission until the data is removed or replaced - Redact — Replace with placeholders and allow submission - Allow — Let it through (logged for admin visibility) Two modes: - Enforce — Policies are active and enforced - Monitor — Policies run in simulation mode. Everything goes through, but you can see what would have been blocked. Great for rolling out to a team without disrupting workflows. Industry presets available for technology, finance, healthcare, and general use. TEAM AND ADMIN FEATURES - Admin dashboard at obfusca.ai — manage policies, patterns, semantic rules, and team members - Role-based access — admins configure, members are protected - Audit log — track 17 types of admin actions - Invite system — invite codes or auto-join by email domain - Detection event history — see what was caught, when, and on which platform (no raw sensitive data stored — only hashes and summaries) PRIVACY BY DESIGN - Sensitive data is never stored — the events log records SHA-256 content hashes and detection summaries only, never the actual values - Fail-closed by default — if the backend is unreachable, submissions are blocked, not allowed through - All detection runs locally in your browser first; the backend enhances with semantic analysis when available - Protected files are generated locally — originals are never uploaded to Obfusca's servers - GDPR and CCPA compliant — consent management, data export, account deletion with 30-day grace period, CCPA opt-out KEYBOARD SHORTCUTS - Enter — Protect and send (when detection popup is open) - Shift+Enter — Send without protection - Escape — Dismiss popup and edit your message PLANS - Free trial — Core detection features included - Individual ($12/month) — Full detection, custom patterns, policies, semantic detection, and dashboard access - Team and Enterprise — Multi-user deployment, advanced semantic rules, industry presets, audit log, and priority support GETTING STARTED 1. Install the extension 2. Click the Obfusca icon and sign in (or create an account) 3. Start chatting — Obfusca works automatically in the background 4. When sensitive data is detected, review the popup and choose how to protect it Questions or feedback? Visit obfusca.ai or reach out through the extension.