Skip to main content

Security

We care about security​

tweak is used by teams across web application development, quality assurance, and security testing. We take that responsibility seriously. Here's what we actually do about it, without the marketing spin.

  • Manifest V3 extension. Every permission we request maps to a capability the product actually provides, no more:

    • Host permissions (since v0.2.0) power core request interception, including requests fired at page load.

    • storage and unlimitedStorage (the latter since v5.0.3) keep your rules on your device, and cover storing larger rule payloads beyond the default 10MB quota, since request data can get heavy depending on the site.

    • scripting (since v7.0.0) injects the interception logic into the page. It is the Manifest V3 replacement for what the background page used to do.

    • declarativeNetRequestWithHostAccess (since v9.0.0) powers the rule types the browser applies itself, rather than tweak from inside the page. Concretely it lets you:

      • dynamically modify HTTP request and response headers (headers only rules);
      • redirect and rewrite URLs for API calls (Fetch/XHR) and web assets (redirect rules), so you can point production endpoints at a local or staging environment.

      We use declarativeNetRequestWithHostAccess rather than the broader declarativeNetRequest to keep this privacy-first. The WithHostAccess variant only applies where you have already granted host access. Because tweak already requires host permissions to function, this approach lets us provide powerful network interception without triggering the additional, overly broad 'Block content on any page' install-time warning that the standard API requires. In practice, it means this capability asks for no new host access or warnings beyond what tweak already had.

  • Dependencies are kept current and audited as part of our release process.

  • Source is reviewed before every release, we don't ship code we haven't read.

  • We accept vulnerability reports at [email protected] and will work with you in good faith to fix and disclose responsibly. You can also file a bug report.

Data handling​

tweak does not store your rules, mocks, or intercepted traffic on our servers. Our servers don't participate in the core extension workflow at all, they're used exclusively for premium Subscription management (sign-in, checkout, license validation). Everything you create in the extension (rules, mocks, request/response bodies) is stored locally on your device using the browser's own storage APIs. We don't sync it to the cloud, and we don't have access to it. See storage.sync for context: we deliberately don't use it.

We only leave your device for a small, well-defined set of reasons:

  • Analytics. We use Google Analytics to understand product usage and catch bugs. This never includes the contents of your rules or intercepted traffic.
  • Sign-in. If you sign in with GitHub or Google, the identity provider shares your account email with us so we can associate it with your Subscription. We don't see any other data from your account.
  • Checkout. Payments are handled entirely by Paddle, our reseller and merchant of record. We don't process or store card details ourselves.
  • License enforcement. For paid Subscriptions we process a limited set of technical signals (IP address, device/browser fingerprint, session timestamps) solely to detect account and license sharing. Full detail is in our Privacy Policy.

Full detail on what we collect, why, and for how long is in our Privacy Policy.

Certifications​

We're a small, bootstrapped team. We don't currently hold ISO 27001, SOC 2, or similar third-party certifications, getting audited costs real money and time that, right now, goes into the product instead. If your organization needs a security questionnaire filled out or a custom assessment done before you can adopt tweak, email us at [email protected] and we'll work through it with you directly.

Contact​

Found a security issue, or need something we haven't covered here? Reach us at [email protected], via our contact page, our bug report form, or our feature request form.