Security

Small permissions. Clear boundaries.

This page describes the controls implemented by the product. It avoids guarantees that no software can truthfully make.

Identity and access

Web sessions use Supabase Auth. Remote MCP clients use OAuth 2.1 authorization code flow with PKCE. Extension tokens are scoped, short-lived, stored in Chrome local storage and rotated through a server-side refresh flow.

Data isolation

Every user-owned database table has Row Level Security. Policies bind reads and changes to the authenticated user ID. Service credentials are restricted to server-only paths.

Minimum disclosure

Permission scopes and category restrictions are checked before relevance ranking. Missing permission removes an item from consideration rather than merely lowering its score.

Extension boundaries

The extension requests access only to supported AI sites. It does not request browser history, does not run remote JavaScript and does not continuously upload conversations.

Operational practices

Secrets are provided through deployment environment variables and are excluded from logs. Security headers, schema validation, request limits and privacy-safe structured logging are applied at API boundaries.

Reporting

Send suspected vulnerabilities or unauthorized-access reports to andreivisan82@gmail.com. Please include enough detail to reproduce the issue, but do not include another person’s personal data.