Security

How we keep the extension safe to run in your browser.

Consensus sits inside your browser with access to page content and your API key, so it has to earn that trust. Here's every check we ran against known extension attack classes, and what actually came back.

10
Checks run
5
Issues fixed
4
Verified clean
1
Mitigated by design

Issues found & fixed

Identified during audit, resolved in code
Cross-context messaging (postMessage)
Fixed

Messages passing between the page and the extension shouldn't be trusted just because they showed up. We checked whether sender origin actually gets validated.

Background script sender verification
Fixed

Analysis requests, storage writes, that kind of thing should only ever come from the extension itself. We checked whether that's actually enforced.

Output escaping in rendered UI
Fixed

Links, provider names, model names, video metadata: anything we write into the page dynamically is a potential opening if it isn't escaped first. We checked all of it.

URL parameter encoding
Fixed

API keys and model names get built into outbound request URLs. We checked whether that's done safely.

API abuse / rate limiting
Fixed

A bug or a bad actor could, in theory, fire unlimited paid LLM calls against the same content. We checked whether anything actually stops that.

Verified clean

Audited, no issue found
Host permissions scope
Verified Clean

We checked whether the extension asks for more site access than it actually needs.

Dangerous DOM sinks
Verified Clean

We went through the codebase for unsafe rendering patterns like innerHTML, eval, or dynamic script construction applied to untrusted input.

Credential storage & transmission
Verified Clean

We checked where your API key lives and whether it ever goes anywhere besides directly to your chosen LLM provider.

Script injection targets
Verified Clean

We checked that dynamic script injection only ever targets the extension's own known files, not something remote or arbitrary.

Mitigated by design

Not a code fix, handled structurally instead
LLM prompt injection resilience
Mitigated by Design

Video titles and comments are written by whoever's watching, including people trying to game the system. We checked whether that text could do more than just skew a rating.

These checks are run against known browser-extension attack classes: OWASP's Browser Extension Vulnerabilities Cheat Sheet, Chrome's official MV3 security guidance, and a handful of disclosed real-world extension exploits. What's shown here is the outcome of each check, not remediation detail — this is a status summary, not a full security writeup.