Security
Built to be attacked
A browser extension is highly privileged software. Sessyn is designed on the assumption that someone will try to abuse that.
Reporting a vulnerability
Use the contact form. Tell us what you found and how to reproduce it. We will acknowledge, investigate, and credit you if you would like.
We will never threaten a good-faith security researcher. Please do not access other people's data, degrade the service, or test against anyone else's browser while researching.
Extension permissions
Sessyn requests the minimum set that still lets it protect you:
| Permission | Why | Data to Sessyn |
|---|---|---|
| declarativeNetRequest | Blocking, applied by the browser | None |
| storage | Your settings and exceptions | None — local only |
| activeTab | Read the current site when you open Sessyn | None |
| alarms | Let a site allowance expire when its time is up | None |
| cookies (optional) | Explain cookies on request | None — analysed on device |
| browsingData (optional) | Forget This Site | None — write-only |
| Access to one site (optional) |
Read that site's cookies so they can be explained. Asked for the
site you are on and the domain its cookies belong to — a
.example.com cookie cannot be read with access to
www.example.com alone, and would silently look like no
cookies at all. Never a wildcard across a suffix.
|
None — analysed on device |
<all_urls> (optional) |
Strip Cookie and Set-Cookie on cross-site
requests. The browser applies header rules only to sites you have
granted, and this one is not tied to a single site, so Private and
Lockdown have to ask. Until you grant it, Sessyn says it is
blocking but not stripping rather than implying otherwise.
|
None — Sessyn never sees the requests |
Sessyn does not request webRequest,
history, bookmarks, or
declarativeNetRequestFeedback. Each of those would expose
your browsing. An automated test fails our build if an undocumented
permission is ever added.
That last one is why a beta report cannot tell us which trackers were blocked on your pages: knowing that, page by page, is a browsing history. A report carries your settings, what the browser confirms is installed, and the cookies on a page you chose to capture — written to a file for you to read and send, or not.
Supply chain
The privacy engine has zero runtime dependencies. Each entry point is bundled from the sources in this repository, with no minifier, and the package contains nothing the browser does not load — a build fails if it ships a script nothing can reach. Published builds are reproducible: rebuild the tagged commit and you get the same archive, byte for byte, as the checksum we publish. The extension contains no remotely executed code — the content security policy forbids it.
Honest limitations
Sessyn is not antivirus, not a VPN, and not a password manager. It cannot hide your IP address, and it cannot stop a site you are logged into from knowing that you are you. Blocking capability also differs by browser — Safari does not support the blocking API at all, so Sessyn explains rather than claiming protection it cannot deliver there.