It holds the send when a message is about to carry an API key, a password, or a card number out of the browser.
Before protection starts, here is exactly what happens.
The extension reads the message text you are about to send and checks it against detection patterns in your browser. If something is found, the send is held. Nothing is changed or sent unless you choose it.
Your text and the secret values stay in the browser. Routine background requests never carry message content: a daily check for the signed detection configuration, which cannot change what counts as a finding, and with a Pro license a license check and, when a catch is held, a metadata record of that catch — site, page path, secret type, action, and time, never the secret itself. The source code is public.
Protection is on.
Try it now. Open any AI chat, paste this line, and press Enter:
my key is sk-proj-abcdefghijklmnopqrstuvwxyz123456
The warning appears before the message goes anywhere.