Provider keys stay server-side
Provider API keys are never shipped into the extension. Requests are signed on our servers, which means none of those keys can be pulled out of the extension bundle by anyone who unpacks it. The one key the extension does carry is Supabase's publishable key, which is designed to be public and only identifies our Supabase project. Your own sign-in is the one credential that is not server-side: see Signing in and your password.
Data in transit and at rest
All traffic between the extension, our servers, Supabase (sign-in and database) and provider APIs is TLS encrypted. Saved Highlights and account records are stored encrypted at rest. Payment details never touch our infrastructure — Stripe handles the entire payment flow. Your account password is handled the same way: it travels over TLS directly to Supabase, our sign-in provider, is never received or logged by our own servers, and is stored by Supabase only as a one-way hash. The sign-in tokens that stand in for it afterwards are held in your browser and removed when you sign out.
Keeping the surface small
- The extension requests the narrowest permission set that makes the product work — see Permissions.
- There is no remote code execution: the extension does not fetch and run scripts at runtime.
- Dependencies are kept minimal and updated, and the build is reproducible from source.
- No analytics SDK is embedded in the extension.
Reporting a vulnerability
If you have found a security issue, please tell us before telling anyone else, and give us a reasonable window to fix it. Send the details — steps to reproduce, affected version, and what you were able to access — through the contact page with Security in the subject.
We will acknowledge within two working days, keep you updated while we work, and credit you when the fix ships if you would like to be credited. We will not pursue legal action against anyone acting in good faith under these terms.
Reports that amount to missing hardening headers with no demonstrated impact, denial of service through volume, or social engineering of our team or users.
If something goes wrong
If a breach affects your data, we will tell you what happened, what was accessed, and what we have done — directly, and without waiting for the maximum period the law allows.