Security & Privacy - AI Code Buddy

Is It Safe? YES - Here's Why🔒

              Stored Locally

              API keys are stored in Chrome's encrypted storage, never on any server
            
🚫

              Never Sent to Us

              No backend server exists - we physically cannot access your keys
            
🔐

              Only to AI Provider

              Keys are only sent to your chosen AI provider (Claude, OpenAI, etc.)
            
👁️

              Fully Open Source

              All code is public - audit it yourself, no hidden behavior
            
📊

              Zero Tracking

              No analytics, no telemetry, no usage statistics collected
            
💻

              Offline Option

              Use Ollama for 100% local AI - no network, no API key needed

How Your API Keys Are Stored

Understanding where and how your API keys are stored is crucial for security. Here's the complete picture:

Storage Location

1. You enter API key in extension popup

↓

2. Extension validates the key format

↓

3. Stored in chrome.storage.sync
(Chrome automatically encrypts this storage)

↓

4. Only accessible to this extension
(Websites and other extensions cannot access it)

Chrome's Encryption

Chrome automatically encrypts extension storage using OS-level encryption:

Windows: DPAPI (Data Protection API)
Mac: Keychain
Linux: gnome-keyring or KWallet

Bottom Line: Your API keys are encrypted at rest and only accessible when you're logged into your Chrome profile.

What Data is Sent Where

Complete transparency on all network activity:

Data Flow When You Select Text and Click Hover Button

1. You select terminal output text

↓

2. Extension reads API key from local storage

↓

3. Request sent ONLY to your chosen AI provider
(e.g., api.anthropic.com or api.openai.com)

↓

4. AI provider processes and returns improved script

↓

5. Response displayed in your browser

What Each Party Receives

Entity	What They Receive	Why
Apra Labs (Us)	NOTHING	No backend server exists
Your AI Provider	API key, command output, context	To process your request and return improved script
Websites You Visit	NOTHING	Extension data is isolated from web pages
Other Extensions	NOTHING	Chrome isolates extension storage

Important: When you use cloud AI providers (Claude, OpenAI, Gemini), your command outputs are sent to their servers for processing. For 100% privacy, use Ollama which runs entirely on your local machine.

Privacy Comparison by Provider

Not all AI providers handle data the same way. Here's what each provider sees:

Provider	Data Retention	Data Usage	Privacy Level
Ollama (Local)	None - stays on your machine	Not transmitted anywhere	★★★★★ Perfect
Azure OpenAI	Per your enterprise policy	Not used for training	★★★★★ Excellent
Claude	30 days	Safety monitoring only	★★★☆☆ Good
OpenAI	30 days	Safety monitoring only	★★★☆☆ Good
Gemini	Per Google's policy	May improve services	★★★☆☆ Good

For Maximum Privacy: Use Ollama for completely local processing. Your code never leaves your machine, no API key is required, and it works offline.

Proof of Security: Verify It Yourself

Don't just take our word for it - verify the security claims yourself:

Test 1: Check Network Activity

Open Chrome DevTools (F12)
Go to Network tab
Select text and click the hover button in the extension
Observe: You'll see ONE request to your AI provider's API only
Result: No requests to any other servers

Test 2: Review the Source Code

All code is open source and unminified. Key files to review:

background.js - The ONLY file that uses API keys (line ~89)
popup-multi.js - Where settings are saved (line ~350)
manifest.json - Lists all permissions and allowed domains

// From background.js - the ONLY place keys are used
const response = await fetch(PROVIDER_ENDPOINT, {
  headers: {
    'x-api-key': apiKey,  // Sent ONLY to AI provider
    'Content-Type': 'application/json'
  }
});
// No other usage of API keys in entire codebase!

Test 3: Inspect Permissions

Check manifest.json for extension permissions:

{
  "permissions": [
    "storage",    // Store settings locally
    "activeTab"   // Access current tab only
  ],
  "host_permissions": [
    "https://api.anthropic.com/*",      // Claude API only
    "https://api.openai.com/*",         // OpenAI API only
    "https://generativelanguage.googleapis.com/*"  // Gemini only
  ]
  // NO other domains, NO "all_urls", NO broad permissions
}

Open Source Guarantee: Every line of code is visible on GitHub. No compiled code, no minification, no obfuscation. What you see is exactly what runs.

Security Best Practices

For Your API Keys

Use separate keys: Create a dedicated API key for this extension
Set spending limits: Configure monthly caps in your provider dashboard
Monitor usage: Check your provider's usage dashboard regularly
Rotate regularly: Generate new keys every 30-90 days
Revoke if compromised: Delete and replace keys immediately if exposed

For Maximum Security

Use read-only keys: If your provider supports it (limits damage if leaked)
Enable Chrome profile password: Adds extra layer of protection
Keep Chrome updated: Security patches are critical
Use Ollama for sensitive code: 100% local processing, zero network risk
Load from source: Clone the repo and load unpacked for maximum control

For Your Privacy

Choose Ollama: For completely private, local AI processing
Review provider policies: Understand how each provider handles data
Avoid sensitive data: Don't send credentials or private keys to cloud AI
Use Azure for enterprise: Better compliance and data governance

Potential Security Risks & Mitigations

Being transparent about potential risks and how to mitigate them:

Scenario 1: Extension Compromise

Risk: If the Chrome Web Store version gets compromised

Mitigation:

Load from source (GitHub) instead of Chrome Web Store
Review code updates before installing
Chrome reviews all extensions before publishing
Use read-only API keys if available

Scenario 2: AI Provider Breach

Risk: Your chosen AI provider (Claude, OpenAI, etc.) gets hacked

Mitigation:

Set rate limits in provider dashboard
Use separate keys for different tools
Monitor usage regularly
Rotate keys monthly
Use Ollama to avoid cloud providers entirely

Scenario 3: Local Computer Compromise

Risk: Malware on your computer

Mitigation:

Use antivirus software
Keep OS and software updated
Use Chrome profile password
Note: No extension can protect against system-level compromise

Security Checklist

Use this checklist to ensure you're following security best practices:

Downloaded from official source (GitHub or Chrome Web Store)

Reviewed permissions in manifest.json

Checked network activity with DevTools

Using dedicated API key (not shared with other tools)

Set spending limits in provider dashboard

Enabled Chrome profile password

Understand data goes to AI provider only

Considered using Ollama for maximum privacy

Know how to rotate and revoke API keys

What Data We Collect: NOTHING

Complete transparency on data collection:

Data Type	Collected?	Reason
API Keys	NO	Stored locally only
Scripts/Commands	NO	Only sent to your AI provider
Terminal Output	NO	Only sent to your AI provider
Usage Statistics	NO	No analytics whatsoever
Email/Account Info	NO	No accounts required
IP Address	NO	No server to log it
Browser Data	NO	Not accessed

GDPR Compliant: Since we collect zero personal data, there's nothing to comply with. No cookies, no tracking, no data retention policies needed.

Summary: Your Keys Are Safe

Why It's Secure

No backend server = can't be stolen from us
Encrypted local storage = protected by Chrome
Open source = fully auditable
Minimal permissions = can't do much harm
No tracking = completely private

How to Verify

Check network activity (DevTools)
Read the source code (GitHub)
Review permissions (manifest.json)
Use Ollama (no network needed)
Load from source (maximum control)

The ONLY security risk is your chosen AI provider - and that's a conscious choice you make when selecting Claude/OpenAI/etc.

For 100% privacy: Use Ollama (completely local, no API key, no network)