| Version | Supported |
|---|---|
| 1.0.x | ✅ Supported |
If you discover a security vulnerability in Prompt Enhancer, please report it responsibly.
- DO NOT create a public GitHub issue for security vulnerabilities
- Instead, email the maintainer or use GitHub Security Advisories
- Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment: Within 48 hours
- Assessment: Within 1 week
- Fix: As soon as possible, depending on severity
This extension handles:
- API Keys: Stored in
chrome.storage.sync(encrypted by Chrome). Keys are only sent to their respective API endpoints (Google Gemini or OpenAI). - Prompt Data: Enhanced prompts are stored locally in
chrome.storage.localfor history. Data never leaves the browser except for optional API calls. - Permissions: The extension uses minimal permissions (
storage,activeTab) following the principle of least privilege. - Content Scripts: Injected only on specified AI platform domains. No
<all_urls>access. - No Tracking: The extension does not collect analytics, telemetry, or any user data.
- Keep your API keys secret — do not share them
- Regularly rotate your API keys
- Review the extension's permissions in
chrome://extensions/ - Only install from trusted sources (this repository)
Thank you to all security researchers who help keep this project safe.