Extensions
Permissions are limitedEach module requests only the sources and capabilities it needs.
Service Security
SKREP Security
SKREP separates local processing, server-side secrets, and online features so each component receives only the access it needs.
Server
Secrets stay on the serverService credentials are not shipped inside extension packages.
Connections
HTTPS and browser controlsOnline features use appropriate connections and browser security policies.
On this page
01 · Security model
Trust boundaries are explicit
The recorder runs in the browser, service secrets remain on the server, and online features require authentication or a clear user action.
Local processing
Captured results are processed close to your work instead of being sent automatically to a server.
Server-side secrets
Database credentials, payment credentials, and service secrets are not included in extension packages.
Limited permissions
Each module requests only the hosts and browser capabilities it needs.
Verified access
Plan and feature access is determined by server state, not by a local marker.
02 · Extensions
Extensions and local data
An extension captures data in response to user actions on supported sources. Its executable code is bundled inside the extension and does not depend on remotely hosted executable code.
Device security still matters. Local data can remain at risk when a device is infected, a browser profile is shared, or exported files are stored without protection.
03 · Sessions
Authentication and sessions
Account sessions expire and can be revoked. Sensitive requests are validated on the server, and administrator access is denied by default unless the required role is active.
04 · Browser and connections
Browser and connection protection
Production services use HTTPS and relevant browser security policies. Manifest V3 and Content Security Policy help limit an extension to the capabilities it requires.
05 · Payments
Payment security
Payments are completed through payment providers. Provider credentials remain on the server, and paid access is enabled only after the transaction status has been verified.
06 · Backups
Backup security
A backup runs only after you connect a storage service and choose to start it. Backup protection also depends on the security and access controls of the storage account you use.
07 · Incidents
Incident reporting and response
Verified findings are prioritized for impact containment, remediation, recovery, and notification where required. Security reports should be submitted privately and contain only the information needed.
If you discover a token or sensitive data: stop testing, do not copy anything further, and report it immediately through the official support channel.
Need help?
Report a security issue Found a security issue?
Report it privately with minimal reproduction steps, the observed impact, and the extension version. Do not include sensitive data that is not needed.