Security
Built to be attacked
A browser extension is highly privileged software. Sessyn is designed on the assumption that someone will try to abuse that.
Reporting a vulnerability
Email info@sessyn.com. Tell us what you found and how to reproduce it. We will acknowledge, investigate, and credit you if you would like.
We will never threaten a good-faith security researcher. Please do not access other people's data, degrade the service, or test against anyone else's browser while researching.
Extension permissions
Sessyn requests the minimum set that still lets it protect you:
| Permission | Why | Data to Sessyn |
|---|---|---|
| declarativeNetRequest | Blocking, applied by the browser | None |
| storage | Your settings and exceptions | None — local only |
| activeTab | Read the current site when you open Sessyn | None |
| cookies (optional) | Explain cookies on request | None — analysed on device |
| browsingData (optional) | Forget This Site | None — write-only |
Sessyn does not request webRequest,
history, bookmarks, or
declarativeNetRequestFeedback. Each of those would expose
your browsing. An automated test fails our build if an undocumented
permission is ever added.
Supply chain
The privacy engine has zero runtime dependencies. There is no bundler and no minifier in the extension build: the code that ships is the code in the repository. Rule datasets are versioned and signed, and the extension contains no remotely executed code — the content security policy forbids it.
Honest limitations
Sessyn is not antivirus, not a VPN, and not a password manager. It cannot hide your IP address, and it cannot stop a site you are logged into from knowing that you are you. Blocking capability also differs by browser — Safari does not support the blocking API at all, so Sessyn explains rather than claiming protection it cannot deliver there.