COMPANION

Architecture

Security

COMPANION reduces exposure by avoiding a cloud service, narrowing permissions, validating provider data, and isolating untrusted document parsing.

Security posture

There is no developer backend. COMPANION has no account server, prompt-processing API, telemetry collector, remote model loader, advertising network, or file-upload service.

Removing those systems eliminates entire classes of credentials, databases, retention policies, cross-user access controls, and breach surfaces. Local software still has risk, so COMPANION uses least-privilege permissions and layered validation inside the extension.

Least-privilege permissions

Host access is limited to exact supported Claude and ChatGPT HTTPS origins. COMPANION does not request broad access to every website or a general browsing-history permission. Extension routes accept privileged messages only from expected top-frame content scripts on allowed origins.

Claude boundary

Claude usage reads are read-only and same-origin. The signed-in browser session authenticates the request, but COMPANION does not read or persist the session cookie. Numeric samples are stored locally for display and history.

OpenAI boundary

Raw first-party ChatGPT responses remain in the page world. A randomized per-page channel carries only normalized JSON containing recognized bounded numeric fields. The isolated content script validates the message, and the service worker validates sender, frame, origin, permitted keys, units, names, timestamps, numeric ranges, and payload size again.

Lifejacket boundary

The prompt compressor, tokenizer, model weights, and CPU/WebAssembly runtime ship inside the extension. Nothing is downloaded at runtime. Prompt text crosses only internal extension boundaries required for local inference, and prompt text is not stored. A preview requires the user to choose optimized, original, or cancel before submission.

File-conversion boundary

Untrusted document bytes are parsed in an opaque-origin sandbox with no network access, provider-session access, extension storage access, or Chrome extension APIs. The privileged offscreen page relays bytes in and Markdown out. The file is not uploaded to a COMPANION service or retained by the extension.

Known limits

  • Claude and ChatGPT are changing web applications. A provider change can break a selector, endpoint, or response shape.
  • Prompt compression is lossy even with protected-span and fallback checks.
  • Local document parsers may not preserve complex layouts, embedded media, macros, annotations, or scanned text.
  • Browser extensions share the security assumptions and update mechanisms of the browser and operating system.

COMPANION fails closed where practical: unsupported usage rows are omitted, unsafe compression retains the original, and invalid cross-context messages are rejected.

Report a security issue

Send a concise report to zgbrenner@gmail.com. Include the affected version, browser version, reproducible steps, impact, and non-sensitive evidence. Do not send passwords, cookies, account tokens, private prompts, or private files.

Non-sensitive bugs and feature requests belong in GitHub Issues.