Exactly what it covers.
Every site the extension runs on and every pattern it matches, read out of the shipped source by a script. If a claim on this site says the extension catches something, the line that catches it is on this page.
Generated from extension v1.3.4. 52 hostnames, 64 detection patterns, 29 checksum validators.
Where it runs
These are the hostnames declared in the extension manifest. The content script runs on each one before a message is sent, and clean messages are never touched. Universal mode, a Pro and team feature, extends the same scan to every website in the browser.
- aistudio.google.comGoogle AI Studio
- api.together.xyzTogether API
- aws.amazon.comAWS console
- bard.google.comGemini (legacy host)
- beta.character.aiCharacter.AI (beta)
- bing.comBing
- canva.comCanva
- character.aiCharacter.AI
- chat.deepseek.comDeepSeek
- chat.mistral.aiMistral Chat
- chat.openai.comChatGPT (legacy host)
- chatgpt.comChatGPT
- claude.aiClaude
- console.anthropic.comAnthropic console
- console.groq.comGroq console
- copilot.cloud.microsoftCopilot (work)
- copilot.microsoft.comMicrosoft Copilot
- copy.aiCopy.ai
- coral.cohere.comCohere Coral
- dashboard.cohere.comCohere dashboard
- discord.comDiscord
- figma.comFigma
- firefly.adobe.comAdobe Firefly
- fireworks.aiFireworks AI
- gemini.google.comGemini
- github.comGitHub
- google.com
- grok.comGrok
- huggingface.coHugging Face
- jasper.aiJasper
- lechat.mistral.aiLe Chat (Mistral)
- meta.aiMeta AI
- notion.comNotion (com)
- notion.soNotion
- perplexity.aiPerplexity
- phind.comPhind
- pi.aiPi
- platform.openai.comOpenAI platform
- poe.comPoe
- replicate.comReplicate
- slack.comSlack
- stability.aiStability AI
- teams.microsoft.comMicrosoft Teams
- telegram.orgTelegram
- together.aiTogether AI
- web.telegram.orgTelegram Web
- web.whatsapp.comWhatsApp Web
- writesonic.comWritesonic
- www.google.com
- www.perplexity.aiPerplexity (www)
- x.comX
- you.comYou.com
What it catches on the free plan
Free covers every API key and token pattern below, with no monthly cap. Detection runs locally in the browser. Catch history is not sent on the free plan.
| Pattern | Severity |
|---|---|
| OpenAI API key | High |
| Anthropic API key | High |
| AWS Access Key ID | High |
| AWS Secret Access Key | High |
| GitHub token | High |
| Stripe secret key | High |
| Stripe restricted key | High |
| Google API key | High |
| Slack token | High |
| Slack webhook URL | High |
| Discord webhook URL | High |
| Telegram bot token | High |
| Hugging Face token | High |
| Groq API key | High |
| npm token | High |
| GitLab token | High |
| SendGrid API key | High |
| Twilio API key | High |
| JWT | High |
| Private key (PEM) | High |
| Bearer token | High |
| Database connection string | High |
| .env file block | High |
| Password assignment | Medium |
| Generic secret assignment | Medium |
What Pro adds
Personal data, network addresses and custom patterns. The same local detection: the secret values themselves never leave the browser. Severity is the level the warning modal shows.
| Personal data | Severity |
|---|---|
| Email address | Medium |
| US SSN | High |
| Credit card number | High |
| US phone number | Medium |
| EU phone number | Medium |
| IBAN | High |
| Italian codice fiscale | Medium |
| Italian partita IVA | Medium |
| Indian Aadhaar number | High |
| Chinese resident ID | High |
| Brazilian CPF | High |
| Canadian SIN / Australian TFN | High |
| NZ IRD number | High |
| German tax ID (Steuer-ID) | High |
| German VAT ID | Medium |
| French NIR (social security) | High |
| Spanish NIF/NIE | High |
| Argentine CUIL | High |
| Chilean RUT | High |
| South African ID number | High |
| Russian SNILS | High |
| Turkish ID number | High |
| South Korean resident number | High |
| Japanese My Number | High |
| Dutch BSN | High |
| Polish PESEL | High |
| Swedish personnummer | High |
| Danish CPR number | High |
| Norwegian fødselsnummer | High |
| Finnish hetu | High |
| Irish PPS number | High |
| Portuguese NIF | High |
| UK National Insurance number | High |
| Indian PAN card | Medium |
| Mexican CURP | High |
| Mexican RFC | High |
| Singapore NRIC / FIN | High |
| Indonesian NIK | High |
| Network | Severity |
|---|---|
| IPv4 address | Low |
Checksums, not just shapes
Matching a number is easy. These formats are validated against their own check digits and national checksums before the warning fires, which is what keeps a random twelve digits from counting as an Aadhaar:
payment cards (Luhn), Verhoeff check digits, Brazilian CPF, Chinese resident ID, Australian TFN, German Steuer-ID, German VAT ID, French NIR, Spanish NIF/NIE, Argentine CUIL, Chilean RUT, Russian SNILS, Turkish ID number, South Korean resident number, Japanese My Number, Dutch BSN, Polish PESEL, Danish CPR number, Norwegian fodselsnummer, Swedish personnummer, Finnish hetu, Irish PPS number, Portuguese NIF, Italian codice fiscale, Mexican CURP, Mexican RFC, Singapore NRIC/FIN, NZ IRD number, Indonesian NIK.
Your own patterns
Pro and team installs can add regular expressions for internal token formats, and IT can push them to every machine through Chrome policy. The patterns ship inside the extension: no remote configuration can change what counts as a finding.
How to check this page
The tables above are generated from detect.js and manifest.json in the extension source, which is public and MIT. Regenerate this page with:
python3 scripts/gen_coverage.py --extension "/path/to/api-key-leak-intercept/extension"
Stay in the loop.
Technical breakdowns, new system builds, and lessons from deploying autonomous AI. One email a week, direct to your inbox.
Weekly architectural updates. Unsubscribe anytime.