For security reviewers & IT admins
Security & technical details
Exactly how LLM Masker works, what data goes where, and how to verify every claim yourself. Written for the person who has to approve this extension, not for marketing.
The one-paragraph summary
LLM Masker is a Manifest V3 Chrome extension that pattern-scans the text of AI-chat prompts on the device and replaces detected secrets with a placeholder before the prompt is sent. Prompt content never leaves the browser: there is no server in the scan path, no account, no analytics, and no third-party code. The only network request the extension can make is an optional PRO licence check, which carries a licence token and nothing else. The free tier makes zero network requests.
Data flow
AI chat pageprompt text (paste / type / send)
↓
Content scriptintercepts before the site's editor or send
↓
Service workermessage broker · settings · stats
↓
Offscreen documentregex scan, off the page's main thread
↓
Masked text returns[REDACTED_BY_LLM_MASKER] replaces each match
Everything above happens inside the browser. The single dashed line out of it — the optional PRO licence check to llmmasker.com/api — carries no prompt content, ever.
Exactly what leaves the device
| Scenario | Network traffic from the extension |
|---|---|
| Free tier — scanning, masking, dashboard, settings | None. No scan-path server, no telemetry, no font/CDN fetches (all assets are bundled). |
| PRO licence stored | One HTTPS GET to llmmasker.com/api/verify on browser start and every 24 hours, with the licence token in the Authorization header. Nothing else is sent — no prompt content, no browsing data, no install identifiers. |
| Buying PRO | Happens on llmmasker.com in a normal tab via Razorpay's checkout — the extension itself is not involved in payment. |
| Visiting llmmasker.com | Website only, not the extension. The site runs Google Analytics 4 with Google Signals off and analytics cookies denied by default in the EEA/UK/CH (cookieless pings). Custom events are coarse (page, CTA location, plan, FAQ opened) — never emails, licence codes or prompt content. |
| Purchase emails (licence delivery / resend, payment failed, cancellation) | None from the extension. Sent server-side by the licence backend through Resend, triggered only by Razorpay billing events or an explicit "Resend my licence" request. Transactional only — no marketing without a separate opt-in. |
Verify it yourself: open any supported AI chat, open DevTools → Network, filter by the extension, and type or paste secrets into the prompt box. You will see no requests. That test is the whole privacy claim, falsifiable in one minute.
Masking mechanics & the fail-safe
- Detection is pattern-based (regex) with validation where it matters — credit cards must pass Luhn, IBANs mod-97 with a country length table, Aadhaar Verhoeff. Roughly 90 patterns in 13 user-toggleable groups: AI provider API keys (OpenAI, Anthropic, Google, ElevenLabs, Groq, Perplexity, xAI, OpenRouter, Hugging Face, Replicate, Pinecone, LangSmith, Tavily), cloud credentials (AWS, Google OAuth, Azure, DigitalOcean, Alibaba, Vault, Terraform), developer platform tokens (GitHub, GitLab, npm, PyPI, Docker, Vercel, Sentry, Grafana, Postman and ~20 more), payment keys (Stripe, Razorpay, Square, Shopify, Braintree), messaging tokens and webhook URLs (Slack, Discord, Telegram, Twilio, SendGrid, Mailgun, Mailchimp, Meta, X), private-key blocks, connection strings with embedded passwords, context-gated
password=/api_key:/Authorization:assignments, JWTs, emails, phone numbers, cards, IBANs, US SSNs and Indian/UK/Canadian national IDs, optional public IPv4 — plus user-defined rules on PRO. Every pattern is anchored to a vendor prefix, a checksum, or an assignment context; bare high-entropy strings are deliberately not matched. Formats are cross-checked against the open-source gitleaks and TruffleHog rulesets, and a regression suite (tests/detectors.test.js) asserts both hits and non-hits on ordinary prose and code. - Three interception points: paste (before the page's editor receives the text), while typing (debounced), and at send (Enter / send-button — always on while protection is enabled).
- Fail-safe: after masking for send, the field is re-scanned. If a detected secret is somehow still present, the send is blocked with a visible notice — a detected secret is never sent raw.
- Honest limitation: pattern detection cannot recognise free-form secrets (a password written as a plain word, novel token formats). LLM Masker is a strong safety net, not a guarantee, and our terms say the same.
Permissions, and why each exists
| Permission | Used for |
|---|---|
storage | Settings and local statistics (schema below). |
offscreen | Runs regex scanning in an offscreen document so large pastes never jank the chat page. |
alarms | Schedules the 24-hour PRO licence re-check. |
| Host access: the 7 AI surfaces | chatgpt.com, claude.ai, gemini.google.com, copilot.microsoft.com, chat.deepseek.com, perplexity.ai, and google.com — where the content script must run to mask prompts. On google.com the script touches only the AI Mode composer, never ordinary Search. |
Notably absent: tabs beyond the active-tab basics, history, webRequest, cookies, <all_urls>, and remote code of any kind.
What's stored locally
| Key | Contents |
|---|---|
settings | On/off state, per-detector toggles, masking-timing preferences; on PRO also custom rules and the allowlist (allowlist values are, by design, stored so they can be exempted — on this device only). |
masker_stats | A total count and an event log of label + category + timestamp only (PRO adds the site hostname). The matched secret value is never stored — not even locally. Caps: 50 events / 30 days free; 1,000 events / 12 months PRO. User-erasable in Settings. |
pro_license | The signed licence token, if PRO was activated. |
Uninstalling the extension deletes all of it.
Licensing security
- Licences are signed tokens (HMAC-SHA256). The extension sanity-checks claims locally, but the server verdict is the sole authority — a forged token fails verification.
- Fails closed: a network error never grants PRO; the extension keeps the last server-verified state. Server-side revocation takes effect within one 24-hour cycle.
- No accounts. The licence server stores only the Razorpay subscription ID, plan, status, the buyer email Razorpay provides, and timestamps of the transactional emails it sent — nothing linked to extension activity. Payment credentials are handled entirely by Razorpay.
- Licence resend is enumeration-proof. "Resend my licence" only ever emails the address already on the subscription, answers identically whether or not that address exists, and is throttled per licence — the code is never displayed to the requester.
Supply chain
- The extension ships zero third-party libraries. No bundler output from npm packages, no analytics SDK, no remote scripts (MV3 forbids remote code, and we use none anyway). Fonts are bundled locally.
- The licence backend runs on Google Cloud (Firebase Functions, asia-south1) with two dependencies (
firebase-admin,firebase-functions); all cryptography uses Node's built-incrypto. - The extension is packaged from a clean directory containing only runtime files — reviewable in the Web Store's source viewer.
Reporting a security issue
Found a vulnerability or a detector bypass worth fixing? Email support@llmmasker.com with the details — security reports are read first and answered fastest. Please don't include real secrets in reproduction steps; the shape of the value is enough.