Wiretype 0.1.0

First release. Not yet on the Chrome Web Store — see PUBLISHING.md for what is outstanding.

Install

Unzip, then in Chrome or Brave: chrome://extensions → enable Developer mode → Load unpacked → select the unzipped folder.

Chrome 114+ for the browser side panel. The in-page panel works everywhere, which is the primary surface — Brave does not expose chrome.sidePanel.

What it does

Detects third-party scripts reading the contents of form fields, and warns which field is affected before you type into it. Three tiers, kept distinct: a known vendor is present; a script was watched reading a field that happened to be empty; a script read a field with content in it.

Privacy

Field contents never leave sensor.js — the value is read for a length check and nothing else. No network requests, no server, no account, nothing persisted.

Verify it yourself rather than taking it on trust:

node tools/build.js

157 checks, including a static enforcement of that invariant, and the build refuses to package if any fail. Every check has been negative-tested — each one confirmed to fail when the thing it guards is broken.

Known limits

• contenteditable fields are not instrumented.
• A tracker on a subdomain of the site itself is treated as first-party. Deliberate: it prevents accusing a site of tracking itself via its own CDN, at the cost of missing CNAME-cloaked trackers.
• The vendor list is curated and finite — 60 entries, matched against real production script URLs by tools/smoke-realworld.js.