AegisGate Lens

Privacy-first Chrome extension. Detects PII, secrets, XSS, and compliance issues in AI prompts. 100% on-device. Free.

Privacy-first browser extension that warns you in real time — before you hit send — when your AI prompt contains PII, secrets, source-code risks, or compliance-relevant language. AegisGate Lens runs 100% in your browser. It watches what you type into 8 of the top consumer AI chat tools, and shows a top-of-screen banner the moment sensitive content is detected. Your prompt never leaves your device. The detector is four regex facets, 132 patterns, and sub-millisecond latency. No network calls. No ML inference on a remote server. No prompt content logged anywhere. No accounts. No telemetry by default. WHAT IT CATCHES AegisGate Lens scans your prompt for sensitive content across four categories of risk: • Personal data — government-issued IDs, contact information, financial account numbers, and biometric identifiers. Includes the formats used in the United States, European Union, United Kingdom, Canada, Australia, Brazil, and India, with structural validation (Luhn for cards, IBAN mod-97, BIP39 wordlist for seed phrases). 55 patterns. • Credentials and tokens — access keys for cloud infrastructure, source-control platforms, payment services, team-messaging tools, and email-delivery providers, plus OAuth and JWT tokens and PEM private keys. The detector recognizes 41 distinct credential formats. • Source-code risks — script injection, event handler abuse, dangerous URL schemes, mutation XSS patterns, and SVG-based payloads. These are the patterns that would cause an AI tool to echo malicious content back to a user. 12 patterns. • Compliance-relevant language — references to frameworks and regulations that an enterprise security team needs to flag for review: the OWASP LLM Top 10 risk categories, MITRE ATLAS adversary techniques, articles of the EU AI Act, and parallel frameworks for Brazil, the United Kingdom, and other jurisdictions. The detector is conservative — it flags for human review, it does not adjudicate. 24 patterns. WHAT'S NEW IN v0.1.4 • "Lens active" indicator is now clickable — click the chip in the top-right of every supported AI chat page to open the extension popup. • Hide the "Lens active" indicator permanently — a new Settings toggle in the popup, for users who prefer an invisible extension. • Pause AegisGate Lens for 1 hour or 1 day — useful for bulk paste-and-review workflows. • "Not PII" dismiss button — one-click false-positive reporting for the user, with the dismissal stored on-device for 24 hours per domain. • 10-second timeout on the opt-in telemetry fetch — prevents a hung service worker if the opt-in backend is slow or unreachable. BENCHMARK RESULTS (v0.1.4, 2026-07-14) Tested against 6,500 real user prompts from the public WildChat corpus and a per-pattern corpus of 12,000+ synthetic PII / secret / compliance records: • False-positive rate: 2.31% (150 of 6,500 WildChat prompts flagged) • 5.1× improvement over the v0.1.0-beta baseline (7.40% FPR) • Latency p99: 0.14 ms on 500-character prompts (sub-millisecond; suitable for inline keystroke detection) • Node unit tests: 500/500 passing • Go smoke tests: 3/3 passing • Headless smoke (real Chromium): 16/16 passing, 5/5 stable runs • Mini-smoke (per-provider, real Chromium): 128/128 passing PRIVACY ARCHITECTURE (OUR DIFFERENTIATOR) We are the only AI security tool where the privacy guarantee is enforced by what we cannot do, not what we promise: • No server round-trip • No prompt content ever crosses a wire • No model upload, no inference API • No third-party SDK • No analytics SDK • No cookies • No fingerprinting • No A/B testing • No crash reporting • No remote config • No update checks beyond the standard Chrome update channel • No accounts, no sign-in, no email capture Cloud-based competitors all see your prompt content. We cannot, because we never receive it. For SOC 2, HIPAA, GDPR, and EU AI Act compliance, that architectural fact matters. Telemetry is opt-in (off by default), domain-hashed, and limited to non-content metadata: hashed domain, category, severity, and the action you took (cancel / redact / send / false-positive). The hashed domain is rotated periodically. The fetch has a 10-second AbortController timeout (v0.1.4 hardening). HOW IT WORKS 1. You type into a supported AI chat tool. 2. After a 300 ms debounce, the content script runs the four-facet regex detector. 3. If a match fires, a brand-matched banner appears at the top of the page showing the category, severity, and a masked value (e.g., "SSN: 123-…6789"). 4. You choose: Cancel send / Edit & redact / Send anyway / This is a false positive. 5. Nothing leaves your browser. HOW IT COMPARES AegisGate Lens vs. cloud-based competitors: • Pricing: Free, forever — no seat license, no enterprise tier • Architecture: 100% on-device, not a cloud-side service • Sees prompt content: Never, by architectural design • Latency: 0.14 ms p99, suitable for inline keystroke detection (cloud alternatives add network round-trip latency) • Open source: Yes (Apache 2.0), threat model and architecture published • Privacy moat: Cannot see prompts, because we never receive them For a full side-by-side comparison including named commercial alternatives, see our website's comparison page. SECURITY POSTURE • SLSA L2 build provenance, Ed25519 bundle signing, Sigstore, Rekor • Manifest V3, strict CSP, no eval(), no Function(), no inline event handlers • Sender-id validation (F-01) in the service worker — messages from foreign extensions are rejected • Domain hashing (F-12) for any opt-in telemetry • AbortController timeout on the telemetry fetch (v0.1.4 hardening) • Zero npm dependencies, zero node_modules, single-binary extension • 14 STRIDE findings: 11 resolved, 2 residual, 1 accepted • Threat-model score: 9.5/10 PERMISSIONS (FULL TRANSPARENCY) The manifest requests exactly three permissions and one host permission: • storage — for the per-domain 24h dismissal map, the opt-in state, the FP-report queue, and the on-device event ring buffer. • scripting — for dynamic content-script injection into supported AI chat tabs via chrome.scripting.executeScript (src/background.js). Used as a fallback when a tab navigates to a supported host but the static content_scripts.matches hasn't fired (Cloudflare interstitials, SPA sub-pages). The injected file list is the same as the static content_scripts.js list; no user data is read. All storage is local (chrome.storage.local + chrome.storage.session); no values ever cross a wire. On-device cap: MAX_EVENTS_RING (1000) + MAX_USER_ACTIONS (100) per the v0.1.1 design. • unlimitedStorage — quota flag; the storage permission's default quota is too small for the per-domain dismissal map at scale (a power user with many distinct subdomains would hit the default quota). We do not store unbounded data; this just raises the cap so the cap we DO enforce is the one in the code, not Chrome's default. • host_permissions: https://lens.aegisgatesecurity.io/* — the opt-in FP-report backend endpoint. Network egress is opt-in only; by default the extension makes zero network calls. The host permission is required so the service worker can POST the sanitized FP report (domain-hashed, category-only) when the user has opted in. Removed in v0.1.2: alarms. The original v0.1.0-beta manifest declared `alarms` defensively for a "deferred dismissal" timer, but the actual implementation stores a timestamp with the dismissal record and checks it on read (lazy expiry in `src/util/dismiss.js`). The `chrome.alarms` API is never called. Per CWS's policy "Remove any permission that is not needed to fulfill the single purpose of your extension," `alarms` was removed from the v0.1.2 manifest. We do not request activeTab (the content script matches 13 specific host patterns, not "the active tab"). We do not request <all_urls>, tabs, webRequest, webRequestBlocking, proxy, or debugger. ROADMAP • v0.2.0 (Q3 2026) — Firefox and Edge support; 7 vertical packs (Healthcare, Finance, Legal, EU AI Act, Manufacturing, Federal, Defense) as free in-Lens add-ons that map to paid AegisGate Platform compliance modules ($79–$499/mo per module) • v0.3.0 (Q4 2026) — Per-team dashboards via the AegisGate Platform, custom user patterns, detection history export LICENSE Apache 2.0. Copyright © 2024–2026 AegisGate Security, LLC. SUPPORT • Issues: https://github.com/aegisgatesecurity/aegisgate-lens/issues • Privacy policy: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/docs/PRIVACY-POLICY.md • Security policy: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/SECURITY.md • Threat model: https://github.com/aegisgatesecurity/aegisgate-lens/blob/main/docs/THREAT-MODEL.md • Marketing site: https://aegisgatesecurity.io/lens/