SecureLint – Sensitive Data Protector

Detects and masks API keys, passwords, and secrets in real-time across all web editors. Keeps sensitive data private as you type.

🔒 SECURELINT – SENSITIVE DATA PROTECTOR & PHISHING SHIELD SecureLint automatically detects and masks sensitive data — API keys, passwords, tokens, credentials, and personal information — as you type or paste into any web-based editor. It also blocks phishing sites, malware domains, and IT-restricted websites in real-time before they can reach you. ──────────────────────────────────────── 🌟 KEY FEATURES ──────────────────────────────────────── 🔍 Universal Editor Support Works across all major web editors and platforms: • Standard inputs, textareas, and contenteditable elements • Rich text editors: CodeMirror, Monaco, Ace, TinyMCE, CKEditor • Popular productivity, project management, email, and coding platforms 🎨 Editor Overlay • A subtle icon appears at the bottom-right of any active editor • Shows a live count of detected secrets, color-coded by severity • Hover to see exactly what was detected and the risk level • Non-intrusive — disappears when you're not in an editor 🛡️ Real-Time Phishing & Malware Protection • Blocks dangerous sites BEFORE they load using a 2.5M+ domain blocklist • 14-layer detection engine: bloom filter, URL heuristics, homograph/IDN analysis, typosquat detection, WHOIS domain-age check, SSL certificate validation, and Google Safe Browsing (Transparency Report) • Page-content scanning for credential-harvesting, crypto-drainer, and social-engineering language • Beautiful warning page shows trust score, domain age, SSL status, blocklist status, and detailed detection reasons • If Google Safe Browsing confirms the site is safe (all threat flags false), the site is automatically unblocked — no false positives from local heuristics 📧 Webmail Protection (Gmail, Outlook, Yahoo Mail) • Detects and masks secrets typed or pasted into email compose fields • Shows a DLP warning if sensitive content is detected before you send • Checks whether the email is addressed outside your organisation (Enterprise only) • All checks are local — no email body content is transmitted 🚨 4-Level Risk Classification • 🔴 Critical – Private keys, AWS credentials, certificate secrets • 🟠 High – Passwords, API keys, OAuth tokens, database URLs • 🟡 Medium – Emails, phone numbers, SSNs, connection strings • 🔵 Low – Generic tokens, test credentials, low-risk identifiers 🧠 Context-Aware Masking • Development Mode: Shows partial secrets (sk-1234****5678) so you can debug • Content Writing Mode: Full masking (***API_KEY***) for blogs and documents • Automatically detects which mode applies based on URL, element type, and content ⚙️ Fully Configurable • Toggle detection globally or per-site • Set minimum severity level for auto-masking • Choose masking style: Smart, Full, Compliance-Safe, or Context-Aware • Exclude specific websites from scanning • Export detection reports 🔐 100+ Detection Patterns including: • Major cloud provider credentials (AWS, GCP, Azure) • JWT tokens, OAuth access/refresh tokens • Database connection strings (MongoDB, Redis, MySQL, PostgreSQL) • Private keys and certificates (RSA, EC, PGP) • Payment, messaging, and developer service API key formats • SSNs, Aadhaar numbers, credit card patterns ──────────────────────────────────────── 🏢 ENTERPRISE & PRO — FOR IT & SECURITY TEAMS ──────────────────────────────────────── SecureLint includes Pro and Enterprise tiers designed for organisations: 🚫 WAF Social & Content Blocking (Pro & Enterprise) • IT administrators define a blocklist of domains (social media, streaming, non-work sites) via the SecureLint admin panel • Users on managed devices are instantly blocked when navigating to listed domains — no page content loads • Domain lists sync every 60 seconds so policy changes take effect immediately • Domain-list blocks cannot be bypassed by end users 🔞 Adult-Content Detection (Enterprise only) • When enabled by IT, the extension scans visible page text locally for adult/explicit content • Pages with explicit material are blocked with a policy warning • No page content is ever transmitted — scanning is 100% in-browser 🛡️ Enterprise Incident Reporting (IT Admin Feature) • IT administrators can enable centralised incident reporting from within the extension settings • When enabled, the extension sends masked detection reports to the organisation's SecureLint security dashboard • Reports include: secret type, severity level, masked preview (e.g. AKIA****XXXX), page URL and title, and employee email — RAW SECRET VALUES ARE NEVER SENT • Allows the IT/security team to: – Detect recurring leak patterns across the organisation – Alert the employee and trigger secret rotation before damage occurs – Meet compliance and DLP (Data Loss Prevention) requirements • This feature is OFF by default — only an IT admin can enable it • Employees are notified via a visible "Enterprise Reporting — Active" banner inside the extension popup ──────────────────────────────────────── 🔏 PRIVACY ──────────────────────────────────────── For Free and Pro individual users: • All detection, masking, and phishing checks happen 100% locally in your browser • No page content, typed text, or detected secrets are ever sent to any server • Phishing checks use Google's public Transparency Report endpoint (no API key, no user data sent — only the URL is queried) • WHOIS lookups query rdap.org; SSL checks query crt.sh — both are public, free services • Only your extension settings are synced if you create an optional account For Enterprise users: • Masked incident reports are sent to your organisation's admin dashboard only when your IT admin explicitly enables this • WAF domain lists are fetched from your organisation's settings via authenticated HTTPS • Raw secret values and page content are never transmitted — only masked previews and metadata • Full disclosure: https://securelint.in/privacy.html ──────────────────────────────────────── 👥 WHO IS THIS FOR? ──────────────────────────────────────── ✅ Developers – Catch hardcoded secrets before they leak in code reviews or collaboration tools ✅ Security Engineers – Enforce secret hygiene across teams working in web tools ✅ Content Writers – Mask sensitive info before pasting into documents or emails ✅ DevOps Teams – Prevent credentials from appearing in chat or ticket systems ✅ IT Admins – Deploy enterprise-wide DLP with centralised incident visibility, phishing protection, and site blocking ✅ Remote Workers – Stay protected from phishing and social engineering on managed devices ──────────────────────────────────────── 📋 PERMISSIONS EXPLAINED ──────────────────────────────────────── SecureLint requests only the permissions it needs: • Access to all websites (host_permissions): Required to detect secrets on any site and to run phishing checks on navigated URLs. All scanning is local. • Storage: Saves your settings, cached scan results, and WAF domain lists locally. • Scripting: Used to read visible page text for phishing content analysis (credential-harvesting detection, crypto-drainer phrases) and enterprise adult-content scanning. Text is processed in-browser and never transmitted. • Web Navigation: Monitors navigation events (onBeforeNavigate, onCompleted, onErrorOccurred) to block known phishing domains before pages load and run full security scans after pages load. • Tabs: Sends setting updates to open tabs and reads the active tab URL for phishing detection context. • Active Tab: Allows the popup to display live detection stats for the current page. • Alarms: Schedules periodic settings sync (every 60 seconds) to keep WAF domain lists current, and token-expiry checks. • Notifications: Alerts you when a Critical secret is detected (optional, can be disabled). • Downloads: Used only if you export a detection report to a file on your device. • Context menus: Adds "Scan page for secrets" and "Mask selected text" right-click options. Full permission and privacy details: https://securelint.in/privacy.html ──────────────────────────────────────── 🔗 LINKS ──────────────────────────────────────── • Privacy Policy: https://securelint.in/privacy.html • Enterprise Reporting: https://securelint.in/privacy.html#enterprise-reporting • WAF & Content Blocking: https://securelint.in/privacy.html#waf-social-block • Support / Feedback: contact@vaptlabs.com • Manifest V3 · Minimum Chrome 88+