Chrome extensions · evidence discipline · agentic security

The expensive bugs do not throw

Four guides from five weeks building a Manifest V3 browser extension that records a web application's own network traffic — against an undocumented target that changed its entire API stack mid-project. They return something reasonable-looking, and you find out weeks later when a number does not match a screenshot. This site is the guard rail: what to build first, what to verify against, and the six ways it goes quietly wrong.

The six silent failures → Read the method first → The 34-check rubric →

If you read nothing else

The four guides compress to five sentences. They are the site's front page because they are good enough to be one.

1

Build a deliberately stupid recorder first

No parsers, no domain model — just keep the bodies. Every parser you write afterwards is written against evidence instead of a guess.

2

Verify every derived fact against an artefact the system itself produced

Every claim that survived this project was checked against something the target emitted independently. Every claim that collapsed was plausible and unchecked.

3

The expensive bugs do not throw

An old build, a size cap that excludes exactly the evidence you're testing for, res || {}, new Blob([undefined]). Each looked like success for days or weeks.

4

Missing is null, and null never becomes 0, '' or {}

Report coverage next to results, so "there is no edge here" and "we never looked here" stay different sentences.

5

Leave the corrections in

A doc with visible errata is one you can trust the rest of. This site does the same — including at its own expense.

A narrow instrument, stated before the code

This is an instrument for observing your own session and your own data, on an account you hold, recording only what the service already sent to your browser. It originates no requests, transmits nothing, and captures no message content in any mode. Anyone reading it as a scraping guide has the wrong document — and the four invariants below are what make it safe to leave running, not just what make it defensible.

Never originates a request

It wraps fetch/XHR and reads what came back.

Never blocks, delays or alters a response

The original promise is returned untouched; the body is read from a clone.

Never throws into the page

Every hook is wrapped in try/catch.

Never transmits

Export is a manual download.

The full ethics position and the participant disclosure →

One shipped, four specified

The founder's own words: the extensions here are "all with different levels of quality." The measured answer, confirmed 8 September 2026: one has been built. A site showing only the shipped one would be a more flattering artefact and a less useful one — the unbuilt designs bought platform findings without a line of code.

1shipped — the recorder, v0.16.0
4specified, never built
34rubric checks, each traceable to an incident
March → September 2026

The arc

A plan (recalled), a shipped tool (measured), a correction (read) — three efforts, three epistemic states, the newest correcting the oldest before a line of code existed.

Read →
Platform findings, no code

The unbuilt

Key Vault, risk cards, the Scribe, the secrets manager, the manifest as a profile, and the vault as storage — six proposals, each dated, each stating what it discovered.

Read →

The four guides

Written by an agent for other agents, 8 September 2026, from a project at v0.16.0: ~3,400 lines of extension source, 176 tests, 33 numbered lessons, 12 capture runs. They ship here almost unchanged — the site adds navigation and cross-links, not a rewrite. Read guide 01 first, because the method is what produced the rest.

01 · read first

The method

How the human and the agent divided the work, phase 0, evidence discipline, corrections left in place, the failure-mode table.

Read →
02

The extension

MAIN vs ISOLATED world, capture modes, storage, the circuit breaker, build provenance, the boundary that only fails once data gets big.

Read →
03

Reading payloads nobody documented

Probing envelopes, deriving timestamps from identifiers and proving them, reading markup over English, document-shaped payloads.

Read →
04

Vaults, scoped to this project

The code/data split, the deriver as the seam, per-entity records with history, and a viewer that ships as one file.

Read →

Built from the guides, not restated

Most-linked

The six silent failures

What each cost — ten days, three weeks, a 113 MB export written as the word "undefined." Every one invisible by construction.

Read →
Day-one

The checklist

The details that save a reader a day each: document_start in MAIN world, the double-injection guard, deny-lists over allow-lists.

Read →
34 checks, 6 sections

The quality rubric

Grade an extension yes / no / not-applicable against incidents that actually happened — and see the three efforts graded against it, including this project's own.

Read →
Source of truth

The documents

The four guides, readable in-page, with the raw markdown as the source of truth underneath.

Read →

What this site does not cover

The guides are written from one extension: a passive recorder that never originates a request. A guidance site that implies broader coverage than its evidence supports fails its own rule.

No page-modifying extensions. No injected UI into a target. No declarativeNetRequest. No OAuth flows. No multi-origin content scripts. No Chrome Web Store publishing guide. No comparison of extension frameworks. And the target the recorder was built against is never named — see the boundaries and disclosure.