Packaged execution
Extension JavaScript, CSS, service catalogs, and UI resources ship inside the extension package. No developer-hosted executable code is loaded at runtime.
SiteEgress security
A bounded browser observer, not an all-seeing network sensor.
SiteEgress minimizes retained data, uses packaged code, treats page-derived evidence as untrusted, and clearly describes what browser-based inspection cannot observe.
Bounded data structures
Reports, evidence, queues, destinations, caches, and history are capped to reduce denial-of-service and memory-growth risk.
Untrusted page evidence
Messages from page context are schema-validated, rate-limited, sanitized, and bound to Chrome sender and document identity where available.
Output safety
Externally derived labels are escaped, dynamic identifiers are minimized, CSV exports are protected against formula injection, and HTML exports use a restrictive CSP.
Geo minimization
Geo Insights deduplicates public server IPs, excludes private ranges, limits concurrency, discards raw IPs, and stores only country-level aggregates.
No false coverage claim
SiteEgress cannot see server-to-server transfers, browser-internal pages, every service-worker request, encrypted body contents, or a recipient's later data use.
Responsible disclosure
Send security reports to [email protected] with the affected version, reproduction steps, impact, and a safe proof of concept. Do not access or retain data that is not yours. We will acknowledge valid reports and coordinate remediation and disclosure timing.
Contact securityExamples in scope
- Extension privilege escalation
- Report or export injection
- Cross-origin data exposure
- Permission bypass
- Geo Insights retention or disclosure defects
- Supply-chain or packaged-code integrity issues
Out-of-scope testing
- Automated scanning that degrades service
- Social engineering or phishing
- Denial of service without a concrete product-specific flaw
- Header-only findings without demonstrated impact
- Testing against websites or accounts without authorization