Security

A tool that drives your logged-in browser deserves a paranoid design. reins keeps the attack surface small by having no cloud half at all — the pieces only ever talk to each other, on your machine.

Network surface

• Everything binds 127.0.0.1 — neither the daemon nor the extension is reachable from the network.
• /rpc and the other daemon endpoints validate the Host header, so web pages can't reach the daemon even through rebound DNS.
• The daemon accepts extension WebSocket connections only from exact allowlisted chrome-extension://<id> origins. Browsers stamp that header themselves — pages and other extensions can't forge it. Dev builds are added explicitly with reins allow <id>.

Visibility and control

• Chrome shows its native "is being debugged" banner whenever the extension is attached to a tab — you always know when an agent is acting.
• The toolbar popup's Disconnect toggle severs the daemon connection instantly.
• Nothing happens in the background: the extension only acts on explicit commands sent through the CLI on your machine.

Data handling

• Page content and tab metadata are read via the Chrome DevTools Protocol only when your local daemon asks, and are sent only to that daemon over localhost.
• No analytics, no telemetry, no tracking, no remote servers, no remote code.
• The only stored state is the extension's own settings — auto-connect, cached daemon port, connection status — kept in chrome.storage on your device.

The full policy lives at reins.karnstack.com/privacy. The code is MIT-licensed and auditable at github.com/karnstack/reins.