Privacy Policy — CodeGuardian Live
Applies to version 1.0.0 and later. Last updated 4 September 2026.
CodeGuardian Live makes no network requests of any kind. It has no server, no account system and no analytics. Everything it does happens inside your browser, on your machine, and nothing it sees is transmitted anywhere.
That is not a promise about intent — it is a property of the code, and the last section of this page shows how to verify it yourself in a few seconds.
What the extension accesses
Code you copy
On a supported developer or AI-chat site, when you copy a code block, the extension reads the selected text and analyses it in the page. The analysis is pattern matching and lightweight data-flow tracking, all of it running in your browser.
The copied text is held in memory for the duration of the scan and then discarded. It
is never written to storage and never sent anywhere. The clipboardRead
permission is not requested: the extension reads the selection inside the copy event
itself, so it structurally cannot see anything you copied elsewhere or at another time.
Files you choose to scan
The "Scan a file" page reads a file only after you pick it or drop it in. The file is
read with FileReader inside that tab and analysed in memory. Its contents are
not uploaded, not stored, and not written to history.
Downloads (optional, off by default)
If you turn on download watching, the extension asks for the downloads
permission and then records the name, size and origin of source files you
download, so it can offer to scan them. It cannot read a downloaded file's contents — the
Chrome downloads API does not expose them — and it does not try. Turning the feature off
revokes the permission and clears the list.
What is stored on your device
In chrome.storage.local, which lives on your computer and is never synced
by this extension:
| Key | Contents |
|---|---|
settings | Your preferences: on/off, severity threshold, strict mode, per-site pauses. |
history | Up to 200 scan records. Each holds a timestamp, the hostname, the detected language, the rule ids, names, severities, CWE ids and line numbers. No copied code, no URLs, no page titles, no query strings. |
stats | Counters: how many scans, how many findings, how many at each severity. |
pendingDownloads | Only if download watching is on: file names, sizes and origins, capped at 20 entries. |
"Clear data" in the popup erases the history and the counters. Uninstalling the extension removes all of it.
Where the extension will not run
Scanning is blocked in code — with no setting that can switch the block off — on
banking and payment sites, authentication and SSO pages, government and military domains,
healthcare and patient portals, password managers, and cryptocurrency exchanges. The
block list is in src/content/domain-guard.js and is enforced before any
selection is read.
Mail and chat surfaces (Gmail, Outlook, Slack, Teams, WhatsApp Web) are blocked by default and can be enabled individually if you choose.
Where the extension does run
Content scripts are declared for a fixed list of developer and AI-chat sites: Stack Overflow and Stack Exchange, GitHub, GitLab, Bitbucket, dev.to, Medium, MDN, Microsoft Learn, AWS docs, npm, PyPI, CodePen, JSFiddle, Replit, ChatGPT, Claude, Gemini and v0. The extension requests no host permissions beyond those matches and is never injected into "all sites".
Permissions, and why each one exists
| Permission | Why |
|---|---|
storage | To keep your settings and the local scan history on your device. |
activeTab | So the popup can tell you whether scanning is active on the site you are currently looking at, and so you can pause that one site. Granted only for the tab you are on, only when you open the popup. |
contextMenus | To add one right-click item, "Scan selection with CodeGuardian". |
sidePanel | To show the scan history in Chrome's side panel. |
alarms | A periodic timer reserved for future rule-catalog updates. It makes no network request today. |
downloads, notifications | Optional. Requested only if you turn on download watching, and revoked when you turn it off. |
What is never done
- No data of any kind is transmitted off your device.
- No account, no sign-in, no identifier is created or stored.
- No analytics, telemetry, crash reporting or usage measurement.
- Nothing is sold, shared, or disclosed to anyone — there is nothing to sell and no channel to send it over.
- No code you copy is stored, even locally.
- No remote code is fetched or executed; the entire rule catalog ships inside the extension.
Children
This is a developer tool and is not directed at children. It collects no personal information from anyone, of any age.
Changes to this policy
Any change is published with the version that introduces it. Because the extension has no server, a policy change can only reach you through an extension update from the Chrome Web Store.
Contact
Questions about this policy or about the extension's data handling can be sent to the address published on the Chrome Web Store listing.
Verifying these claims yourself
Download the extension source and run these in its folder. Each one checks a specific claim above rather than asking you to take it on trust.
# 1. No network primitive exists in any execution path.
grep -rnE "fetch\(|XMLHttpRequest|WebSocket|sendBeacon|navigator\.connection" src/ \
--include=*.js | grep -v "^src/rules/" | grep -v "^src/core/"
# (rules/ and core/ are excluded because they contain detection *patterns*
# for these APIs, which is the opposite of calling them)
# 2. The content policy forbids connections outright.
grep "connect-src" manifest.json # → connect-src 'none'
# 3. clipboardRead is never requested.
grep -c clipboardRead manifest.json # → 0
# 4. History holds no code. This assertion is part of the test suite.
node tests/run-tests.mjs
# 5. The whole pipeline, end to end, with storage inspected afterwards.
npm install jsdom && node tests/e2e-pipeline.test.mjs