Shadow Form Filler Chrome extension security report

Shadow is a privacy-first Chrome extension that fills forms for you — without sending your data anywhere. Every field you save is encrypted on this device with a key that never leaves it. The extension works offline, refuses 16 sensitive field types by default (credit cards, passwords, SSN, 2FA, financial txns…), and writes an audit entry every time it fills a form so you can see exactly what was sent where. BYOK AI is optional. If you bring your own OpenAI, Anthropic, or MiniMax key, the extension can parse a pasted name or address and fill in 13 fields from one block of text. If you don't, the heuristic matcher still works on 98% of real-world forms. What's in v0.6.5: Encrypted vault (AES-GCM 256-bit, device-bound key, never persisted) Source-readable TypeScript — every line is human-readable, no minification Per-site quick-fill rules — opt in once, then "one keystroke" for repeat sites AI-assisted parse with allow-listed schema (only the fields you asked for) Audit log with JSON / CSV export, filterable by domain and field Master pause switch + emergency purge (irreversibly wipes all local data) 6 icon sizes, MV3, content scripts over <all_urls>, no remote code What this extension does NOT do: No telemetry, analytics, or "phone home" of any kind No cloud sync — your data lives on this device only No third-party crypto — WebCrypto only No form auto-submission — you always review and click Submit yourself No password or credit-card auto-fill — refused at the matcher level