Packaged execution
Extension JavaScript, CSS, service catalogs, and UI resources ship inside the extension package. No developer-hosted executable code is loaded at runtime.
SiteEgress security
Bounded browser security.
SiteEgress minimizes retained data, uses packaged code, treats page-derived evidence as untrusted, and clearly describes what browser-based inspection cannot observe.
런타임 강화
이름 전용 분류, 스키마 메시지, 증분 DOM 검색, 활성 상태에서만 Geo 관찰.
Bounded data structures
Reports, evidence, queues, destinations, caches, and history are capped to reduce denial-of-service and memory-growth risk.
Untrusted page evidence
Messages from page context are schema-validated, rate-limited, sanitized, and bound to Chrome sender and document identity where available.
Output safety
Externally derived labels are escaped, dynamic identifiers are minimized, CSV exports are protected against formula injection, and HTML exports use a restrictive CSP.
체크포인트 최소화
시간 창과 보존 수를 제한하고 동적 값을 정리하며 영수증에 제한적 CSP를 적용합니다.
Geo minimization
Geo Insights deduplicates public server IPs, excludes private ranges, limits concurrency, discards raw IPs, and stores only country-level aggregates.
No false coverage claim
SiteEgress cannot see server-to-server transfers, browser-internal pages, every service-worker request, encrypted body contents, or a recipient's later data use.
Local Suite bridge
Fixed extension IDs, dual opt-in, schema validation, origin scoping, bounded caching, and field projection protect the optional peer channel.
Responsible disclosure
Send security reports to [email protected] with the affected version, reproduction steps, impact, and a safe proof of concept. Do not access or retain data that is not yours. We will acknowledge valid reports and coordinate remediation and disclosure timing.
Contact securityExamples in scope
- Extension privilege escalation
- Report or export injection
- Cross-origin data exposure
- Permission bypass
- Geo Insights retention or disclosure defects
- Supply-chain or packaged-code integrity issues
Out-of-scope testing
- Automated scanning that degrades service
- Social engineering or phishing
- Denial of service without a concrete product-specific flaw
- Header-only findings without demonstrated impact
- Testing against websites or accounts without authorization