Security

Updated 27 October 2026

Guardpup is built so that the safest answer to "what if Guardpup were hacked?" is: there's nothing of yours on our side to take.

Everything Happens on Your Device

• What you type, paste or attach never leaves your computer. Text, files and screenshots are checked there. We never receive them.
• It can't send what you type anywhere. The extension's pages are locked by their security policy so they can reach only guardpup.io (connect-src 'self' https://guardpup.io), from one module, in three cases: after you sign in for Pro, to check your plan (the request carries a device key, never content); once a week if you turn on anonymous usage counts (totals with no content and no ID; the settings page shows the exact report); and once a week if your company turns on its team report (totals with no names and no content; Guardpup tells you). Otherwise it makes no network requests at all. One exception you start by hand: Check my AI history can read your own past chats from chatgpt.com or claude.ai, in your signed-in tab, and checks them on your computer. Nothing goes to Guardpup. The Mac app runs in Apple's App Sandbox, makes the same checks (plus asking for the newest version number), and can read only your Desktop, Documents and Downloads folders, and any other folder you allow, read-only, after macOS asks you, to check images you drop on an AI app. Our tests fail if any of this widens.
• No remote code. Everything, including the text-recognition and PDF engines and their models, ships inside the package. Nothing is downloaded at runtime.

Least Access

• The extension runs only on the AI sites it supports, each listed by name. It doesn't ask for access to all websites, your tabs, history, cookies or downloads.
• Its permissions: local storage, a hidden page to read images and PDFs, a timer (for "pause for an hour") and its right-click menu item. For Check my AI history, it may also read pages from chatgpt.com and claude.ai, two sites it already runs on, and only when you click. Five more AI sites are asked for only if you turn them on, with the permission to start its checks there.
• Websites can't detect that it's installed: it exposes no files to them.

What It Keeps, and How

• Things you ask it to protect are stored as salted one-way fingerprints (SHA-256), never as the values. Company secrets in a policy are the same, made in the admin's own browser.
• The real values behind stand-ins live only in the tab's memory and are gone when it closes. When you copy from the chat, the extension puts them on your clipboard itself; the page never receives them.
• History records what kind of thing was caught, never the thing itself.

Companies

• Company rules arrive through a team link, or through Chrome's or Edge's managed policy, which employees can't change (being tested). Either way they can only make Guardpup stricter.
• Licences are checked offline with a digital signature; checking one never contacts us. If Guardpup disappeared tomorrow, installed copies would keep working.
• The setup page can't send anything anywhere: its own security policy forbids it.
• Security questionnaire or a call with your security team? Talk to us.

Report a Vulnerability

Email security@guardpup.io with what you found and how to reproduce it. We'll reply within 3 business days, keep you updated, and credit you if you'd like. Please give us a reasonable time to fix it before making it public.

We won't take action against good-faith research that avoids harming users and their data, doesn't disrupt AI services, and stays within your own accounts and devices.

Machine-readable: /.well-known/security.txt.

How We Measure

Every detection rule is checked against real data before it ships, and again after any change. The numbers on the home page come from these runs (October 2026):

• False alarms in code: about 13,000 files of SDK source code, chosen because it's full of key-like strings, tokens in tests and examples. Target and result: 0 flagged.
• Catches in code: 20 kinds of realistic credentials, each planted at the start, middle and end of real files. Result: all 60 found. Checked against gitleaks, an independent open-source scanner: no kind it knows that Guardpup misses.
• Screenshots: screenshots with planted secrets, in different layouts, fonts and image qualities, plus clean ones. One set was used while tuning; a second was made afterwards with new values and layouts and never tuned against. Both: 100% found (27 October; the tuned set was 92% on 15 October). No clean screenshot was flagged, and every covered screenshot was read again to make sure nothing was left readable.
• Real prompts: 1,372 real prompts sent to AI tools. The extra "check your message" for a password mentioned loosely fired on 0.2% of them, each time about a real password.

These are test sets. Your messages will include things no test set has, so Guardpup is one layer of protection, not the only one.

Honest Limits

• Guardpup reduces the chance of a leak; it can't catch everything, and a person can choose to send anyway unless their company turns that off.
• A weak password can be guessed back from its fingerprint by someone who has copied your browser profile; strong ones can't. Such a person would also have your saved logins.
• Not yet independently audited. We'd rather say so than imply otherwise.