Security
How we keep the extension safe to run in your browser.
Consensus sits inside your browser with access to page content and your API key, so it has to earn that trust. Here's every check we ran against known extension attack classes, and what actually came back.
Issues found & fixed
Messages passing between the page and the extension shouldn't be trusted just because they showed up. We checked whether sender origin actually gets validated.
Analysis requests, storage writes, that kind of thing should only ever come from the extension itself. We checked whether that's actually enforced.
Links, provider names, model names, video metadata: anything we write into the page dynamically is a potential opening if it isn't escaped first. We checked all of it.
API keys and model names get built into outbound request URLs. We checked whether that's done safely.
A bug or a bad actor could, in theory, fire unlimited paid LLM calls against the same content. We checked whether anything actually stops that.
Verified clean
We checked whether the extension asks for more site access than it actually needs.
We went through the codebase for unsafe rendering patterns like innerHTML, eval, or dynamic script construction applied to untrusted input.
We checked where your API key lives and whether it ever goes anywhere besides directly to your chosen LLM provider.
We checked that dynamic script injection only ever targets the extension's own known files, not something remote or arbitrary.
Mitigated by design
Video titles and comments are written by whoever's watching, including people trying to game the system. We checked whether that text could do more than just skew a rating.