Rewrite AI - Paraphrase & Rewrite Text Chrome extension security report

Rewrite AI by NeuralWriter helps you paraphrase and rewrite text directly from any webpage. ⚡ HOW IT WORKS 1. Select any text on a webpage 2. Press Ctrl+Alt+P (or click the extension icon) 3. Choose Light mode (fast, minor changes) or Hard mode (deep rewriting, higher uniqueness) 4. Get your rewritten text instantly ✨ KEY FEATURES • Two rewriting modes: Light (quick, preserves meaning) and Hard (deep rewrite, high uniqueness) • Works on any webpage - just select text and use the keyboard shortcut • Built-in uniqueness score for each rewrite • Supports 11 languages: English, Spanish, French, German, Italian, Portuguese, Russian, Ukrainian, Chinese, Japanese, Korean • Clean popup interface - no new tabs, no redirects • Local Engine mode for offline English rewriting (no server needed) • Cloud AI mode powered by NeuralWriter's backend 🔧 HOW THE EXTENSION CONNECTS TO THE AI BACKEND NeuralWriter's rewrite API requires an authenticated session token. The token bootstrap page is hosted by NeuralWriter and is designed to run in a normal browser context, so the extension loads that owned page in a Chrome MV3 offscreen document before making rewrite requests. To handle this transparently for the user, the extension: 1. Creates a background offscreen document (Chrome MV3 standard API) containing an iframe that loads a token page on research.neuralwriter.com 2. The page initializes the JWT token browser session 3. A narrowly matched content script reads the session token from the loaded NeuralWriter page and passes it to the extension's background worker 4. The token is stored locally and refreshed every 50 minutes to stay valid 5. When the user paraphrases text, the popup sends the text along with this token to the NeuralWriter API The iframe URL includes a unique identifier parameter (qJFXgLwe2a3jwRvb3HPGWFRYboWk4q-rewrite) so the token-extraction content scripts and network rules are scoped to pages carrying this parameter. The separate user-facing hotkey content script runs on all pages only to listen for Ctrl+Alt+P, read the user's current text selection, and display the local extension popup when the user invokes the feature. This is why the extension requires the offscreen and declarativeNetRequest permissions: the iframe needs X-Frame-Options headers removed on NeuralWriter subframe requests so the owned token page can load inside the offscreen document, and the token content script needs to interact with that loaded NeuralWriter page to extract the authentication token.