PRIVACY POLICY — SaaS SECURITY SCANNER
THE SHORT VERSION
This extension does not collect, store, transmit or sell any personal
information. There is no account, no sign-in, no analytics, no telemetry, and
no server belonging to the developer. Every analysis runs inside your own
browser, and the results are discarded when you close the browser.
WHAT THE EXTENSION READS
When you open the panel on a page, the extension reads the following from the
page you are already viewing, in order to analyse it:
- The HTTP response headers of that page, to check security headers such as
Content-Security-Policy, Strict-Transport-Security and X-Frame-Options.
- The attributes of that site's cookies — the cookie name, the Secure,
HttpOnly and SameSite flags, and the domain scope — to check whether
session cookies are protected.
- The page's DOM: links, images, scripts, forms, headings and meta tags, to
check for mixed content, SEO markup and technology fingerprints.
- The keys stored in localStorage and sessionStorage, to warn you when
something token-shaped is readable by any script on the page.
- The browser's Performance timeline for the page, to measure load timings.
- The current tab's URL and title, to label the report and to build the
search-result preview.
Cookie values are never read — only the attributes listed above. Storage keys
are inspected; a stored value is examined only to test whether it has the shape
of a JSON Web Token. Neither keys nor values are transmitted anywhere.
WHERE THE DATA GOES
Nowhere. It is held in memory while the panel is open, and in Chrome's session
storage, which the browser clears when it closes. It is never written to a
remote server, because the extension has no server to write to.
NETWORK REQUESTS
The extension makes network requests in exactly two situations, and in both
cases only to the website you are already looking at:
1. Re-reading the current page. If you open the panel on a page that finished
loading before the extension started, it requests that same URL again in
order to read its response headers. This request is sent without your
cookies.
2. "Scan the rest of the site". Only when you press that button, the
extension fetches up to the number of pages you choose (12 by default)
from the same domain, to find problems that appear only when pages are
compared with each other. These requests are also sent without your
cookies, so any page behind a login returns a redirect rather than your
data. This feature never runs automatically.
No request is ever made to a third party, to the developer, or to any analytics
service.
PERMISSIONS
The extension requests access to all sites because you may want to audit any
site you visit, so the permission cannot be limited to a fixed list of domains.
It is used only to read the page you have explicitly asked it to analyse. The
extension has no automatically running content script, never modifies any page,
and never reads a page you have not opened the panel on.
DATA YOU ENTER
The extension has no input fields, no settings that hold personal data, and no
sign-in. Nothing you type anywhere else in the browser is read by it.
CHILDREN
The extension is a developer tool and is not directed at children.
CHANGES TO THIS POLICY
Any future change will be published together with the extension update that
introduces it, and the date at the top of this document will be updated.
CONTACT
Questions about this policy: readyandmakes@gmail.com