v1.1.1: reliable backups, clear disclosures and security hardening

AGENTS.md

@@ -7,8 +7,8 @@
   CONTRIBUTING.md for scope, templates, and validation.
 - Never push changes directly to `main`; do not merge or publish without the
   user's instruction.
-- Unpublished work for this upgrade stays in version `1.1.0`. Bump the version
-  for a subsequent release after this update is published.
+- The published release is `1.1.0`; the approved follow-up targets `1.1.1`.
+  Keep related unpublished work in `1.1.1` until this update is published.
 - Keep the extension local, dependency-free, and compatible with Manifest V3.
 - Package runtime files and icons only, with `manifest.json` at the ZIP root.
 - Keep builds, store assets, signing keys, and private notes under ignored `local/`.

CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 1.1.1 — 2026-10-20
+
+### Added
+
+- First-use/update disclosure of automatic local traffic and credential storage, with affirmative continuation and existing-workspace recovery.
+- Installed Help/privacy guidance for capture, Auto scope, active requests, debugger access, local storage and backups.
+- Bounded chunked JSON-lines backups with optional authenticated AES-256-GCM encryption, progress, integrity verification and legacy JSON compatibility.
+- A design proposal for password-protected local storage; the current database remains unencrypted.
+
+### Improved
+
+- Removed redundant `tabs` permission after browser checks of tab selection, Auto mode, workbench focus and HTTP/HTTPS/file attachment.
+- Restricted messages and ports to expected extension pages, validated temporary header rules and tracked dashboard ownership across closure/restart.
+- Clearer API Builder authentication fields and compact editors that leave more space for response assertions.
+- Updated title, summary, privacy/permission guidance, workflow screenshots and recommended 128px icon padding.
+- Release packaging derives its version from the manifest and includes new local runtime helpers.
+
+### Fixed
+
+- Local-file history no longer prevents reopening or restoring a workspace; active API requests remain HTTP(S) only.
+- Backups above the former 200 MB ceiling round-trip in the bounded format, including encryption overhead.
+- Import reads cannot race; canceling prevents late previews, and passwords clear after success or failure.
+- Missing/revoked disclosure acceptance disables saved Auto and prevents silent restart after acknowledgment.
+- Backup chunks yield through queued tasks, avoiding Chrome’s background timer throttling.
+- Rule cleanup preserves other dashboards' active rules and removes orphaned rules on restart.
+
 ## 1.1.0 — 2026-10-03
 
 ### Added

CONTRIBUTING.md

@@ -27,9 +27,9 @@ Read [README.md](README.md), [PRIVACY.md](PRIVACY.md), and
    actually performed. Maintainer review and merge complete the issue.
 
 Do not push directly to `main`. Do not merge, tag a release, or publish to the
-Chrome Web Store as part of a contribution. The pending upgrade stays at
-**1.1.0** until it is published; follow the release version instructions in
-[AGENTS.md](AGENTS.md).
+Chrome Web Store as part of a contribution. The published release is **1.1.0**;
+the approved next update is **1.1.1**. Keep related unpublished work at that
+version and follow the release instructions in [AGENTS.md](AGENTS.md).
 
 ## Local setup
 

PRIVACY.md

@@ -1,79 +1,145 @@
 # Privacy Policy — Interceptor
 
-_Last updated: 2026-10-03_
-
-Interceptor is a browser extension for inspecting and modifying the HTTP traffic
-of web pages you are testing. This policy explains what it does with data.
-
-## Short version
-
-**Interceptor does not collect, store remotely, sell, or send your data to the
-developer. Traffic analysis happens locally in your browser.** Repeater, API
-Builder, Runner, and credential comparisons send requests to the target you choose
-when you start them. Security Review and imports send no requests.
-
-## What the extension accesses
-
-To do its job, Interceptor can read and modify the network requests and responses
-of the tab you attach it to (or, in Auto mode, the tab or tabs you enable). This
-can include URLs, headers (such as cookies), and request/response bodies. This
-information is processed **on your device**, only to:
-
-- display traffic in the extension's own panel (HTTP history, intercept, repeater),
-- apply the modifications you explicitly make or the Auto-mode rules you configure.
-- inspect WebSocket frames, run response assertions, and review captured security evidence.
-
-## What is stored
-
-The extension automatically saves the workbench **locally on your own computer**,
-in the browser profile’s IndexedDB database (`interceptor-workspace`). This covers:
-
-- captured/imported HTTP history and bounded request/response bodies;
-- Repeater drafts, responses, five snapshots per tab, and assertions;
-- Collections, notes, shared variables, and named environments;
-- API Builder drafts and authentication fields, response previews, and test results;
-- Runner plans/results, Comparer inputs, Decoder and Inspector drafts;
+_Last updated: 2026-10-20_
+
+Interceptor is a browser workbench for inspecting, reproducing, and testing HTTP
+and WebSocket traffic for applications you own or are authorized to test. This
+policy explains the data it handles and the controls you have over that data.
+
+## What happens to your testing data
+
+**The developer does not receive your testing data.** The extension collects
+selected traffic for your testing workflow, processes it on your device, and
+saves your work in your browser profile. There is no account, analytics,
+telemetry, cloud synchronization, or developer-operated collection service.
+
+Repeater, API Builder, Runner, and credential comparisons send the requests you
+start to the target servers you choose. Intercepted or automatically rewritten
+page requests continue to their intended servers when you forward them or enable
+Auto mode. Those servers receive the request data and may retain it under their
+own policies. Passive Security Review, decoding, comparisons of existing text,
+and file imports do not send testing requests. Restoring a backup sends no
+requests and does not attach the debugger.
+
+## First use and help
+
+Before new testing begins, Interceptor displays a local-data notice that explains
+automatic saving, credentials, target requests, and backup controls. Continuing
+acknowledges that notice; it does not send a request or attach a tab. The Help
+entry lets you revisit these explanations and this privacy policy. Existing work
+is preserved when the notice appears. A pre-acceptance recovery download preserves
+the saved record for recovery; if that record is damaged, the download does not
+guarantee it can be restored without repair. It is unencrypted and can contain
+credentials.
+
+## Information the extension accesses and uses
+
+You select which tab to attach for inspection, or which tab(s) Auto mode may
+operate on. The tab selector uses open-tab titles and URLs so you can identify a
+testing target. The extension can read and modify the selected traffic’s URLs,
+headers, cookies, request and response bodies, and WebSocket frames. Local file
+inspection can include file paths when browser file access is enabled. Authentication
+fields, shared variables, and environments you enter can include usernames,
+passwords, access tokens, API keys, and session cookies.
+
+Traffic, files, and drafts may contain personal information, website content,
+form data, or other sensitive information depending on the applications you
+choose to test and the data you enter or import. You decide which applications
+and datasets to inspect. The extension does not use these data for advertising,
+profiling, selling, or purposes unrelated to its debugging and testing tools.
+
+Data is used to display and search captured traffic, edit or reproduce requests,
+apply your Auto-mode rules, run response assertions, inspect fields and frames,
+compare results, review security evidence, and save or restore your testing work.
+Security observations guide manual testing and do not establish a vulnerability.
+
+## Local storage
+
+The extension automatically saves the workbench in the browser profile’s local
+IndexedDB database (`interceptor-workspace`). This includes:
+
+- captured and imported HTTP history with bounded request and response bodies;
+- Repeater drafts, responses, up to five snapshots per tab, and assertions;
+- Collections, request notes, shared variables, and named environments;
+- API Builder drafts and authentication fields, response previews, and tests;
+- Runner plans and results, Comparer inputs, Decoder and Inspector drafts;
 - Auto logs, security observations and review status, WebSocket frame previews;
-- recoverable text from paused edits, without restarting those paused sessions.
-
-Settings, Auto-mode rules and pane-size preferences also use `chrome.storage.local`.
-Pane sizes are included in full backups. Session tab IDs and temporary header
-rule IDs use `chrome.storage.session`. Earlier saved drafts and
-Collections are migrated when the workbench opens. No workspace data uses browser
-sync or a remote server. Local records are protected by your computer/browser
-profile access controls; the extension does not separately encrypt its database.
-
-The Workspace page downloads a full JSON backup and imports it after validation
-and a restore preview. Backups include stored credentials. An optional password
-encrypts backups with AES-256-GCM and a PBKDF2-SHA-256 key (200,000 iterations,
-random salt and IV); backup passwords are never saved. Without a password, the
-backup is readable JSON. Restoring replaces the current workspace, keeps a local
-undo copy, leaves Auto mode off, and does not send traffic or attach a tab.
-
-Exporting a collection, HAR, or Runner CSV creates a file at your request.
-Collection exports omit workspace variables, but raw requests can still contain
-cookies or tokens. cURL and Postman imports are parsed as data; shell commands and
-Postman scripts are never executed. Security reports hide known credential query
-fields and cookie values in observation evidence. Captured raw traffic remains
-available locally and is included in full backups.
-
-## What is NOT done
-
-- No data is sent to the developer, advertisers, or analytics services.
-- No analytics, tracking, or telemetry of any kind.
-- No accounts, and no remote code is loaded or executed.
-
-## Your control
-
-You choose which tab(s) the extension attaches to. Detaching, turning Auto mode
-off, and stopping Runner or a request end those operations. Clearing history,
-deleting requests/environments, and clearing results/frames removes those items
-from the current workspace and its next local save. The previous-restore undo copy
-and downloaded files are separate copies. Uninstalling the extension or deleting
-its browser profile removes extension storage; backup files you downloaded remain
-where you saved them.
+- recoverable text from paused edits, without restarting paused sessions.
+
+Settings, Auto-mode rules, and pane-size preferences use `chrome.storage.local`.
+Pane sizes are included in full backups. Session tab IDs and temporary request
+header rule IDs use `chrome.storage.session`. Earlier saved drafts and collections
+are migrated when the workbench opens. No testing workspace uses browser sync or
+a remote database.
+
+The local database is **not separately encrypted by the extension**. Its records
+rely on your computer and browser-profile access controls. Other people or software
+with access to that profile may be able to read stored traffic and credentials.
+Optional backup encryption protects the downloaded backup file, not the local
+database or requests sent to testing targets.
+
+Requests use the transport of the target URL you choose. HTTPS encrypts the
+connection to the target; HTTP does not. Use HTTPS for sensitive testing data and
+keep intentional HTTP testing limited to appropriate test environments.
+
+## Backups, imports, and exports
+
+Workspace backups include the saved traffic, drafts, variables, authentication
+fields, results, and preferences. Without a password, a full backup is readable
+JSON lines with unencrypted encoded data that can expose stored credentials to
+anyone who can access the file. The format processes 1 MiB chunks, with a 1 GB
+workspace-JSON budget and a 1.4 GB file limit. Older plaintext JSON files remain
+importable within the 1 GB budget; older encrypted envelopes have a 200 MB
+compatibility limit. Device memory and browser quotas can impose lower practical
+limits. Rejected imports do not replace your saved work.
+
+A password encrypts each downloaded backup chunk with AES-256-GCM and a
+PBKDF2-SHA-256 key (200,000 iterations, random salt and per-chunk IV). Backup
+passwords are never saved.
+The same password is required to import an encrypted file.
+
+Imports are validated and previewed before replacement. Restoring replaces the
+current workspace, keeps one local undo copy, leaves Auto mode off, and sends no
+requests or debugger attachments. Restored drafts may still contain credentials.
+
+Collection, HAR, Runner CSV, security report, and WebSocket exports create files
+when you request them. Collection exports omit workspace variables, but raw
+requests can still include cookies and tokens. Security reports hide known
+credential query fields and cookie values in observation evidence; this is not a
+guarantee that all sensitive information is removed from every export. Full
+backups and raw captured traffic retain the data you inspected.
+
+cURL and Postman imports are parsed as data. Shell commands and Postman scripts
+are not executed. No remotely hosted code is loaded or executed by the extension.
+
+## Retention and deletion
+
+Saved testing work remains in your browser profile until you remove it, replace
+it through a restore, uninstall the extension, or delete the browser profile.
+Capture and preview limits may also remove older entries or truncate large
+bodies and frames.
+
+Detach or disable Auto mode to stop those operations. Stop or cancel an active
+request or Runner run to end it. Clear history, delete requests/environments, and
+clear results or frames to remove those items from the current workspace and its
+next local save. The previous-restore undo copy is a separate retained copy.
+Downloaded files are also separate; deleting data inside the extension or
+uninstalling it does not delete files you downloaded. Manage or delete those
+files using your computer’s file controls.
+
+## Limited Use
+
+Interceptor’s use of information received from Chrome extension APIs adheres to
+the Chrome Web Store User Data Policy, including its Limited Use requirements.
+Testing data is used only for the extension’s disclosed debugging and API/security
+inspection features. The developer does not receive it, use it for advertising,
+sell it, or use it to determine creditworthiness or for lending. User-started
+requests are sent to the testing targets you choose to provide these features.
 
 ## Contact
 
 Questions or concerns: open an issue at
 https://github.com/user-github-me/interceptor/issues
+
+Please remove credentials and personal data from screenshots, logs, requests,
+backups, or other files before posting them publicly in an issue.