Skip to main content

Security

We care about security​

tweak is used by teams across web application development, quality assurance, and security testing. We take that responsibility seriously. Here's what we actually do about it, without the marketing spin.

  • Manifest V3 extension. Every permission we request maps to a capability the product actually provides, no more:
    • Host permissions (since v0.2.0) power core request interception, including requests fired at page load.
    • tabs (since v3.0.0) lets us open the changelog and documentation page when there's an update.
    • unlimitedStorage (since v5.0.3) covers storing larger rule payloads locally, beyond the default 10MB quota, since request data can get heavy depending on the site.
  • Dependencies are kept current and audited as part of our release process.
  • Source is reviewed before every release, we don't ship code we haven't read.
  • We accept vulnerability reports at [email protected] and will work with you in good faith to fix and disclose responsibly.

Data handling​

tweak does not store your rules, mocks, or intercepted traffic on our servers. Our servers don't participate in the core extension workflow at all, they're used exclusively for premium Subscription management (sign-in, checkout, license validation). Everything you create in the extension (rules, mocks, request/response bodies) is stored locally on your device using the browser's own storage APIs. We don't sync it to the cloud, and we don't have access to it. See storage.sync for context: we deliberately don't use it.

We only leave your device for a small, well-defined set of reasons:

  • Analytics. We use Google Analytics to understand product usage and catch bugs. This never includes the contents of your rules or intercepted traffic.
  • Sign-in. If you sign in with GitHub or Google, the identity provider shares your account email with us so we can associate it with your Subscription. We don't see any other data from your account.
  • Checkout. Payments are handled entirely by Paddle, our reseller and merchant of record. We don't process or store card details ourselves.
  • License enforcement. For paid Subscriptions we process a limited set of technical signals (IP address, device/browser fingerprint, session timestamps) solely to detect account and license sharing. Full detail is in our Privacy Policy.

Full detail on what we collect, why, and for how long is in our Privacy Policy.

Certifications​

We're a small, bootstrapped team. We don't currently hold ISO 27001, SOC 2, or similar third-party certifications, getting audited costs real money and time that, right now, goes into the product instead. If your organization needs a security questionnaire filled out or a custom assessment done before you can adopt tweak, email us at [email protected] and we'll work through it with you directly.

Contact​

Found a security issue, or need something we haven't covered here? Reach us at [email protected], via our contact page, our bug report form, or our feature request form.