Security — ChatBridge

Our security commitment

Security is a core design principle of ChatBridge, not an afterthought. We built the extension with a local-first architecture specifically to minimize the attack surface and keep your data under your control at all times.

Security pillars

🔒

Local-first storage

All data lives in your browser. No ChatBridge servers ever receive your conversation content.

🔑

No key storage

Your AI provider API keys are stored only in your local browser storage and never transmitted to us.

🛡️

Minimal permissions

ChatBridge requests only the Chrome permissions it absolutely needs to function.

👁️

Open source

Our full source code is publicly auditable on GitHub. No hidden backdoors.

Permissions explained

ChatBridge requests the following Chrome permissions and nothing else:

✓activeTab — Reads the current tab's visible content only when you click the ChatBridge button.
✓storage — Saves conversations and settings locally in your browser.
✓alarms — Used for scheduled background tasks like session timeouts.
✓idle — Detects browser idle state to pause background activity.

We do not request tabs, history, bookmarks, cookies, or any other broad permissions.

Cloud Gateway security

If you choose to use the optional Cloud Gateway (Cloudflare Workers proxy), the following protections apply:

All traffic is encrypted in transit via TLS.
Requests are not logged or stored beyond the duration of the request.
Your API keys are passed as request headers directly to the AI provider — they are never stored by the gateway.
The gateway enforces rate limiting to prevent abuse.

Content Security Policy

The extension enforces a strict Content Security Policy on all extension pages:

Only scripts from the extension's own package may execute ('self').
No inline scripts or eval() are permitted.
No third-party scripts can be injected into extension pages.

Responsible disclosure

If you discover a security vulnerability in ChatBridge, please report it responsibly before disclosing it publicly. We take all security reports seriously and will respond promptly.

Report a vulnerability We aim to respond within 48 hours.