Shadow Monitor Chrome extension security report

Shadow Monitor helps QA engineers and developers diagnose bugs during user-acceptance testing — without sending data to the cloud. HOW IT WORKS 1. Open Settings and grant your UAT origin (e.g. uat.example.com). 2. Hard-reload that tab (Cmd/Ctrl+Shift+R) so capture scripts load from page start. 3. Capture runs automatically on every granted origin. Reproduce the bug as usual. 4. Open the popup and click Download to save a uat-report-*.json.gz bundle. 5. Open the included viewer and drop the file to replay DOM, inspect network, console, and storage. LOCAL-ONLY GUARANTEE • Zero network requests to developer servers or third parties • No analytics, telemetry, remote config, or CDN assets • Sanitization on ingest (sensitive headers stripped; secrets redacted in JSON/text) • Optional AES-GCM encryption for the on-disk buffer and for shared export files WHAT IS CAPTURED (on origins you grant) • DOM / interactions — rrweb replay snapshots (passwords, payment fields, and .uat-mask always masked) • Network — fetch, XMLHttpRequest, and sendBeacon (URLs, methods, status, headers, bodies where available) • Storage — localStorage and sessionStorage snapshots • Cookies — non-HttpOnly cookies visible to page scripts (on by default; can turn off) • Console — errors and uncaught exceptions by default (configurable) WHAT IS NOT CAPTURED • WebSockets • HttpOnly cookies • Response bodies for static assets (CSS/JS/images) — metadata only • Any site you have not explicitly granted FOR APP DEVELOPERS Tag sensitive UI with class="uat-mask" or data-uat-mask so it stays out of DOM replay when input recording is on. REQUIREMENTS Chrome 116+. Grant each UAT hostname in Settings before capture starts.