Frequently asked questions
About the product
What does Am I Being Pwned do?
We continuously audit the browser extensions across your device fleet. Every extension is scored 0-100 from static analysis of its code and dynamic analysis in a live sandbox. Each finding links to the evidence behind it.
How is this different from Chrome Web Store's built-in review?
The Web Store screens extensions against known malware signatures. It does not audit for covert data exfiltration, session hijacking, code injection, network tampering, or exploitable CVEs in extension dependencies. We do. Many of the extensions we have flagged were and remain available on the Web Store.
What types of risk do you identify?
We cover five categories: data harvesting (covert upload of browsing history, keystrokes, and form data), session hijacking (theft of auth tokens and cookies), code injection (arbitrary JavaScript execution on visited pages), network tampering (traffic proxying and request modification), and known CVEs in extension code. Every category is based on real findings from live Chrome Web Store extensions.
How accurate are the findings?
Findings come from static analysis, decompilation and an LLM pipeline that reads each extension's code. They can be wrong, so every finding shows its evidence and a confidence level. Findings a researcher has checked are marked Verified.
Data privacy & security
When we receive a list, how is it securely handled when we run a scan?
The list is sent over TLS, matched against our catalog and not stored.
What data does the enterprise product collect?
From each browser: its installed extensions, basic device details (browser, OS, a random device ID) and the signed-in profile's email. Anything you connect, such as Google Workspace or SentinelOne, adds the data listed on our security page. Never browsing history or page content.
Where is data stored, and what certifications do you hold?
Our databases are stored in the EU. We hold no SOC 2 report or ISO 27001 certification; our security page lists the controls we run instead, and you can check them yourself. If you have specific residency or compliance requirements, contact us and we will work through them with you.
Deployment & IT
How long does it take to get started?
Sign up with your work email, then connect Google Workspace or SentinelOne, or deploy our browser extension. The first results arrive within the hour. There are no firewall rules to change and nothing to install on servers.
How does fleet-wide monitoring work?
Either we read the extension inventory a tool you already run collects (Google Workspace or SentinelOne), or you force-install our lightweight browser extension from Google Admin Console and it reports each device's extensions to your dashboard.
Do employees need to install or configure anything?
Not if you use Google Workspace, SentinelOne or force-install the extension through your MDM: nothing changes for them. Without those, you can send employees an enrollment link and they add the extension themselves in a couple of clicks.
What happens when a new risky extension is detected?
It shows up in your dashboard within the hour with the affected devices, the finding and our recommended action, and admins get it by email. You can block it from the dashboard, or set a severity above which risky extensions are blocked automatically.
Compliance & reporting
What does an audit report include?
A point-in-time snapshot of your extension inventory: risk scores, open threats, and what was blocked or resolved, with a CSV export. Compliance reports are on every plan, Free included.
Can reports be used as evidence for procurement or legal review?
Yes. Each finding links to the evidence behind it, so security, legal and procurement teams can check our work.
How current is the risk intelligence?
Our database is updated continuously as we receive new extension IDs to scan from customers.
Pricing
What is included in the free tier?
Continuous monitoring for up to 20 devices and 200 extensions, 3 dashboard seats, Google Workspace, the browser extension, SentinelOne and Vanta, and compliance reports. Malicious-extension write-ups are included in full, and so is blocking, plus a preview of the relationship graph for your own extensions. Sign up with your work email.
What do paid plans add?
More devices and seats, plus webhooks, removal emails to affected employees, vulnerability details, the full relationship graph and actor profiles. Starter covers 100 devices from $39 a month and Business covers 1,000 from $239 a month, billed annually. The full breakdown is on the pricing page.
Other
Is Am I Being Pwned affiliated with HaveIBeenPwned?
No. Am I Being Pwned? is an independent product. Troy Hunt (founder of HaveIBeenPwned) has confirmed he has no objection to the name.
I have found an error in a report. How do I get it corrected?
Get in touch through our contact form with the extension name and the specific finding you believe is inaccurate. We take accuracy seriously and aim to respond within two business days.
I am an extension developer and my extension appears on this site.
If you believe a finding is incorrect, get in touch through our contact form with supporting details and we aim to respond within two business days. If we have inadvertently disclosed an unpatched vulnerability, flag it through our contact form immediately, and we will unpublish the entry to give you time to issue a fix.