Changelog
API Key Leak Intercept: Chrome Extension · Version history
1.3.4: Seats that hold
The catch path now reads the install identifier the extension already sends, so a machine past the seat limit actually stops reporting, including on a personal Pro key. License recovery only emails a key that is still active. A PayPal refund no longer falls back to an email match that could end a different licence. Outbound webhooks from the extension no longer carry the organization token, Slack and Telegram ask for the host permission they need, and every extension-side webhook is checked against private and loopback addresses. The weekly team digest reaches every contact instead of failing on a nested address list. AWS temporary ASIA keys and encrypted PEM blocks are detected, OpenAI’s pattern no longer treats an OpenRouter key as its own, and IPv4 addresses are checked against the 0–255 range. The privacy policy, the welcome page, and the listing copy describe the personal Pro catch history as it actually works.
1.3.3: One paste, one machine
A setup code now works on the very first machine, since the paste field sits on the signed-out screen where a fresh install can reach it. A team joins with one paste and no device management, and each code covers one machine against the seats you bought. A machine past the limit keeps protecting the person at the keyboard and stops reporting, and the dashboard shows that overage instead of showing nothing. Personal Pro runs on five machines per key, and the sixth machine is told how many are already in use. On a force-installed machine an employee can no longer switch protection off or sign out of a seat the company owns, while personal data checks and auto-redaction stay open unless the administrator has locked settings. Applying a code or toggling Universal mode no longer wipes the organization off the machine. Seats are counted once. A ten-seat team used to report full at five. Setup codes report on by default, so a quiet team is still counted. A submit button on a plain text field is scanned the way a chat box always was. A stalled licence check can no longer leave the popup blank, and the welcome screen opens on what happens to your text.
1.3.2: On demand and on schedule
The popup has a Check for updates button. It shows the version you run and asks Chrome to look for a newer one right away, so a release reaches you on your own schedule. Daily license revalidation keeps its 24-hour schedule through service worker restarts, signing out clears the license and entitlement stored on the machine, and the popup refreshes team status before reporting it. Team webhook and alert addresses are checked against private and loopback networks before anything is sent, in the extension and in the cloud.
1.3.1: Coverage and seats
JSON configuration is now read the way a .env file is, so a password or a token key inside a JSON block is caught before it leaves. Secrets written in base64 are recognised whatever characters sit at either end of them. The Irish PPS number check follows the official scheme, identity numbers typed in lowercase are caught as reliably as capitals, and placeholder numbers in the shape of real ones no longer raise a warning. Team seats are counted per installed machine and include machines that report through alerts as well as through heartbeats, so the IT dashboard shows what is running. Auto-redact sends only once the redaction has reached the editor's own text, and the warning dialog masks the preview of what it found. Large pastes scan faster.
1.3.0: One machine, one seat
Team seats now count installed machines. One machine takes one seat, the IT dashboard shows installs in use against the seats bought, and setup codes stop rolling out past the seat count until you add seats.
1.2.8: English, straight
The store submission is English only. The extension UI shipped in English everywhere, so the package no longer carries half-finished translations. The Italian, German, French and Spanish strings are parked until a native speaker signs them off.
1.2.7: If you remove it, I want to know why
Removing the extension now opens a feedback page with a note from me and three questions. It carries the version and nothing about your browsing, and every answer comes to my inbox.
1.2.6: The side button, done properly
The status button now hides completely behind the edge and starts moving the moment your mouse travels up the left side of the window. Landing on it slides it all the way out, five seconds of stillness tucks it back, and unpinning the panel no longer leaves it open until you click somewhere.
1.2.5: The side button tucks away
The status button now sits behind the edge of the window and slides out as your mouse comes near it. A catch brings it out on its own, so the badge is where you expect it the moment something happens.
1.2.4: The clean build
The Pro flag in local storage no longer opens Pro on its own: the license key that proves a verification happened has to be there too. Send buttons that are not real buttons, the ones marked role="button", are now intercepted as well. Everything else in this build is housekeeping for the store submission.
1.2.3: The upgrade button quotes the real price
The Get Pro button in the popup still said $5 a month. It says $7.99, which is what the checkout charges.
1.2.2: Team installs see the right popup
An install running on a team entitlement saw the sign-in upsell instead of the settings panel, even though the Pro features already worked. The panel now opens on the team entitlement, the same way detection does.
1.2.1: Google's AI Mode is now covered
The content script never ran on www.google.com, so a key pasted into Google's AI Mode chat went out unchecked. Google is on the scanned list now, next to gemini.google.com, and the same warning covers the search box. If you tried it on Google before and saw nothing, that was this.
1.2.0: Accounts, consent, and the dialog rebrand
The warning dialog now carries the full product name. You can sign in to the License & Team Console with an email and password: the purchase email carries a one-time link to set the password, Google sign-in sits on the manage page, and the license key keeps working as a sign-in fallback for managed installs. Protection stays off until you accept it on the welcome page. The popup reports whether the last catch reached the console feed. Universal Mode asks for access to other sites only when you turn it on, and the detection patterns ship inside the extension, so no remote configuration can change what counts as a finding.
1.1.0: First public release
First public release. The detection engine runs 64 patterns for API keys, tokens, and personal data, including national identity numbers for 30 countries: US SSN, Italian codice fiscale and partita IVA, Mexican CURP and RFC, Singapore NRIC/FIN, New Zealand IRD, Brazilian CPF, German Steuer-ID, French NIR, Indian Aadhaar and PAN, and more. Before anything sends, the warning modal offers Cancel, Send anyway, and Redact. Free and Pro tiers ship together with team/IT mode (Slack, Teams, Telegram, email, and webhook alerting), universal mode for scanning all websites, and an audit log kept locally and, in team mode, in the cloud. License verification runs through PayPal, and the source is on GitHub.
Back to API Key Leak Intercept · Roadmap · Privacy policy · GitHub