Veri Chrome extension security report

Sign in to websites with a verified email address, without ever handing that address over. Veri is an identity wallet for the web. When you sign in with Veri, the site receives cryptographic proof that your email is real and verified, but never learns what it is. No more inboxes full of newsletters you didn't ask for, no more address sold on to data brokers, no more breach notifications from a site you used once. HOW IT WORKS 1. Install the extension and connect your Veri vault. 2. Browse normally. When you land on a site that supports Sign in with Veri, the extension recognises it and the toolbar icon lights up. 3. Click "Sign in here with Veri". The login completes on its own. The site gets a stable, verified identity it can recognise you by on your next visit. It does not get your email address. A DIFFERENT ADDRESS FOR EVERY SITE Veri gives each site its own distinct identifier, derived separately per site. Two sites comparing notes cannot tell they are talking about the same person. Your identity stays consistent on the site you use it with, and nowhere else. WHAT THIS EXTENSION NEVER DOES - It never stores your private keys, recovery phrase, or session tokens. Those stay in the Veri web app and are never copied here. - It never reads the content of the pages you visit. It checks for a single tag that tells it whether a site supports Veri, and nothing more. - It never tracks your browsing, builds a profile, or sends your history anywhere. - It never contacts third-party servers. It talks only to the site's own public configuration and to Veri. WHY IT NEEDS ACCESS TO ALL SITES Any website can choose to support Sign in with Veri, and there is no way to know in advance which ones do. The extension therefore looks on every page for one specific element that declares support. That check is all it does. It reads nothing else and stores nothing about the sites you visit. WHO IT IS FOR Anyone tired of trading their email address for access. Useful for signing up to services you want to try but do not want to hear from, for voting and governance platforms where you must be verified but wish to stay pseudonymous, and for anyone who would rather not maintain a pile of throwaway addresses. REQUIREMENTS A Veri account with a verified email credential. Free to create at veribeta.io. Open source. Questions and issues: veribeta.io Single purpose (mandatory field) Detects websites that support Sign in with Veri and completes the OIDC login flow on the user's behalf, so the user authenticates with a verified email credential without disclosing their email address to the site. Permission justifications (mandatory, one per permission) host_permissions: Veri detects OIDC-compatible "Sign in with Veri" support on specific partner sites so users don't have to manually check. Host permissions are scoped to our current integration partners: Tailscale, Grafana, and UrVote. As new partners integrate, their domains will be added to this list. storage Stores non-sensitive per-tab state: whether the current site supports Veri, and the user's own configuration. No keys, tokens, or credentials are stored. tabs / activeTab Identifies which tab the user is on so the popup shows the correct site and the sign-in is directed at the right page. scripting Completes the sign-in flow on the active tab after the user clicks "Sign in here with Veri". Runs only in response to that click.