Credentials stay server-side
Provider API keys are never shipped into the extension. Requests are signed on our servers, which means a key cannot be pulled out of the extension bundle by anyone who unpacks it.
Data in transit and at rest
All traffic between the extension, our servers and provider APIs is TLS encrypted. Saved Highlights and account records are stored encrypted at rest. Payment details never touch our infrastructure — Stripe handles the entire payment flow.
Keeping the surface small
- The extension requests the narrowest permission set that makes the product work — see Permissions.
- There is no remote code execution: the extension does not fetch and run scripts at runtime.
- Dependencies are kept minimal and updated, and the build is reproducible from source.
- No analytics SDK is embedded in the extension.
Reporting a vulnerability
If you have found a security issue, please tell us before telling anyone else, and give us a reasonable window to fix it. Send the details — steps to reproduce, affected version, and what you were able to access — through the contact page with Security in the subject.
We will acknowledge within two working days, keep you updated while we work, and credit you when the fix ships if you would like to be credited. We will not pursue legal action against anyone acting in good faith under these terms.
Reports that amount to missing hardening headers with no demonstrated impact, denial of service through volume, or social engineering of our team or users.
If something goes wrong
If a breach affects your data, we will tell you what happened, what was accessed, and what we have done — directly, and without waiting for the maximum period the law allows.