Security
Built to Be Attacked
A browser extension is highly privileged software. Sessyn is designed on the assumption that someone will try to abuse that.
Reporting a Vulnerability
Use the contact form. Tell us what you found and how to reproduce it. We will acknowledge, investigate, and credit you if you would like.
We will never threaten a good-faith security researcher. Please do not access other people's data, degrade the service, or test against anyone else's browser while researching.
Extension Permissions
Sessyn requests the minimum set that still lets it protect you:
| Permission | Why | Data to Sessyn |
|---|---|---|
| declarativeNetRequest | Blocking, applied by the browser | None |
| storage | Your settings and exceptions | None — local only |
| activeTab | Read the current site when you open Sessyn | None |
| alarms | Let a site allowance expire when its time is up | None |
| cookies (optional) | Explain cookies on request | None on its own — analyzed on device. Cookie names, never values, go into a report only if you send one |
| browsingData (optional) | Forget This Site | None — write-only |
| scripting (optional) | Location masking; capturing a page for a report | None on its own — a static script that replaces the geolocation API inside the page, granted only if you turn masking on and removed when you turn it off. Capturing a page borrows it once to list the sites the page loaded, then hands it back. |
| Access to one site (optional) |
Read that site's cookies so they can be explained. Asked for the
site you are on and the domain its cookies belong to — a
.example.com cookie cannot be read with access to
www.example.com alone, and would silently look like no
cookies at all. Never a wildcard across a suffix.
|
None — analyzed on device |
<all_urls> (optional) |
Strip Cookie and Set-Cookie on cross-site
requests. The browser applies header rules only to sites you have
granted, and this one is not tied to a single site, so Private and
Lockdown have to ask. Until you grant it, Sessyn says it is
blocking but not stripping rather than implying otherwise.
|
None — Sessyn never sees the requests |
Sessyn does not request webRequest,
history, bookmarks, or
declarativeNetRequestFeedback. Each of those would expose
your browsing. An automated test fails our build if an undocumented
permission is ever added.
That last one is why a beta report cannot tell us which trackers were blocked on your pages: knowing that, page by page, is a browsing history. A report carries your settings, what the browser confirms is installed, the cookies on a page you chose to capture and the third-party sites it loaded — saved to a file for you to read, or sent to Sessyn when you press Send after reading it, or neither.
Supply Chain
The privacy engine has zero runtime dependencies. Each entry point is bundled from the sources in this repository, with no minifier, and the package contains nothing the browser does not load — a build fails if it ships a script nothing can reach. Published builds are reproducible: rebuild the tagged commit and you get the same archive, byte for byte, as the checksum we publish. The extension contains no remotely executed code — the content security policy forbids it.
Honest Limitations
Sessyn is not antivirus, not a VPN, and not a password manager. It cannot hide your IP address, and it cannot stop a site you are logged into from knowing that you are you. Blocking capability also differs by browser — Safari does not support the blocking API at all, so Sessyn explains rather than claiming protection it cannot deliver there.