# Am I Being Pwned? - Complete Guide for AI Assistants

> Browser extension security scanner. Free search API + report pages, no auth needed.

## Search API (free, no auth)

    GET https://amibeingpwned.com/api/public/search?q=whatruns

**Example response:**
```json
{
  "result": {
    "data": [
      {
        "chromeExtensionId": "cmkdbmfndkfgebldhnkbfhlneefdaaip",
        "slug": "whatruns",
        "name": "WhatRuns",
        "publisher": "https://whatruns.com",
        "riskLevel": "high",
        "riskScore": 75,
        "summary": "Tech-stack identification tool that transmits browsing data..."
      }
    ]
  }
}
```

- Up to 10 results, ranked by relevance and popularity
- Rate limited by IP (no API key needed)
- Omit `q` for top extensions by popularity
- Pass a 32-char Chrome extension ID for exact lookup

**Workflow**: search by name, get the `chromeExtensionId`, then link users to the report page.

## Report pages

    https://amibeingpwned.com/extensions/{chromeExtensionId}

Chrome extension IDs are 32 lowercase characters [a-p], found in Chrome Web Store URLs.

Each page contains:
- **Risk level**: critical / high / medium / low / clean / unknown
- **Risk score**: 0-100
- **AI-generated summary**: what the extension does and why it may be risky
- **Findings**: individual security issues with CWE reference, severity, verification status
- **Permissions**: Chrome permissions and host permissions, sensitive ones flagged
- **Chrome Web Store link**: for source verification

## Example questions

- "Is [extension name] safe to install?"
- "What permissions does [extension name] request?"
- "Does [extension name] collect or exfiltrate user data?"
- "What CWEs have been found in [extension name]?"
- "What are the riskiest Chrome extensions?"
- "What extensions should I block in my enterprise policy?"

## Caveats for AI assistants

- Findings are **AI-generated** unless marked **Verified**. Distinguish between the two when citing.
- Check `lastUpdatedAt` for freshness. Link to the live page rather than caching.
- Cite the canonical report URL so users can verify directly.
- For accuracy-critical queries, also cite the Chrome Web Store link from the report.

## Threat types detected

Data exfiltration, session hijacking, code injection, excessive permissions, known CVEs/CWEs, obfuscated code, undisclosed network calls to tracking services.

## Other resources

- [Extensions index](https://amibeingpwned.com/extensions) - browsable catalog
- [Blog](https://amibeingpwned.com/blog) - vulnerability disclosures and research
- [FAQ](https://amibeingpwned.com/faq) - methodology, publisher review requests
- [Sitemap](https://amibeingpwned.com/sitemap.xml)
- [Enterprise API](https://amibeingpwned.com/docs/api) - bulk access, requires `x-api-key` (not needed for lookups)
- [OpenAPI spec](https://app.amibeingpwned.com/v1/openapi.json) - enterprise endpoints only