Wireflip Add to Chrome

Privacy and security

Wireflip is designed to keep request-debugging data on your device.

Data handling

  • Rules and settings are stored in local browser extension storage.
  • Traffic inspector logs are held in memory and disappear when the service worker stops.
  • Request URLs, headers, bodies, rules, and logs are not uploaded to Wireflip servers.
  • Sensitive header values—including Authorization, Cookie, Proxy-Authorization, and Set-Cookie—are redacted in the inspector by default.
  • The website does not need an account to use the extension or SDK.

Permissions

<all_urls> allows rules to target developer-selected endpoints and lets the local SDK bridge identify the real calling page. declarativeNetRequest applies fast rules. debugger enables opt-in Advanced mode. tabs, storage, and sidePanel provide tab scope, persistence, and the inspector.

These permissions are powerful. Install Wireflip only from a source you trust, keep rules narrowly scoped, and disable Advanced mode when the debugging session is finished.

Advanced mode

Advanced mode attaches only after an explicit action for an HTTP or HTTPS tab. Chrome shows its standard debugging disclosure while attached. Wireflip detaches on disable, tab close, debugger takeover, or cross-origin top-level navigation.

SDK boundary

The SDK communicates through a packaged content-script bridge—there is no hosted relay. The extension derives scope from Chrome’s actual sender tab instead of trusting an origin supplied by page JavaScript.

Enabling CORS requires confirmation. Rule drafts created by an app are always disabled and bound to that app’s origin so the user can inspect them before activation. SDK calls are size- and rate-limited.

v1 migration

The first v2 startup creates a local snapshot of v1 settings before writing the validated v2 state. The snapshot is retained for recovery; it is not used as live configuration after migration.

Reporting an issue

Please report privacy or security concerns through the GitHub repository. Do not include real authorization headers, cookies, or private request bodies in a public issue.