Security

Am I Being Pwned? is built and operated by Bay Area Labs Inc. We specialise in analysing browser extensions for malicious, suspicious, and vulnerable behaviour. Our team combines security research experience with engineering expertise in browser internals.

Questions about our security posture? Get in touch via our contact form.

• Edge network - Cloudflare Pages and Workers handle all HTTP traffic, providing DDoS mitigation, TLS termination, and global edge caching. Only static assets are cached at the edge; customer data is not.
• Database - Cloudflare D1, our multi-tenant application database, plus a separate D1 database holding the public extension catalogue. Cloudflare is the only subprocessor with access to customer data, and we will notify enterprise customers before that changes.
• Encryption - TLS 1.2+ in transit. Encrypted at rest, with integration credentials (SentinelOne and Google Workspace tokens) separately encrypted with AES-256-GCM before they are written, so a database read alone does not yield a usable token.
• Authentication - Passkeys, magic links, or Google OAuth 2.0. We never store passwords. Session tokens are signed and httpOnly.
• Secrets management - All credentials and API keys are stored as encrypted environment variables, never committed to source control.

• No public database endpoint - D1 is reachable only through a binding held by our Worker. There is no host, no port and no connection string to leak, steal or expose: an attacker cannot reach the database directly even with stolen credentials, because there is nothing to connect to.
• Integration credentials, encrypted per use site - your SentinelOne and Google Workspace tokens are encrypted with AES-256-GCM under keys derived per use site via HKDF, with a fresh random IV per record. One compromised context cannot decrypt another's data.
• Tokens never stored in plaintext - organisation API keys, device enrolment tokens and invite tokens are stored only as hashes. Device tokens rotate on every sync.
• Hardened API surface - HSTS with preload, X-Frame-Options: DENY, nosniff and a strict referrer policy on every response, Turnstile on public mutations, and per-IP rate limiting at 200 requests per minute.
• Least privilege into your tools - our SentinelOne role holds four read and indicator-write permissions out of roughly sixty, and no permission that can act on an endpoint. Revoke it in your own console at any time, without asking us.

• Notification window - We notify affected customers within 24 hours of confirming an incident involving their data. That is deliberately inside the 72-hour window GDPR Article 33 gives you as controller, because your regulatory clock starts before our investigation finishes.
• What you get - An initial notice with the scope, the data categories affected and the time window, written updates until the incident is closed, and a post-incident report once it is resolved.
• How we reach you - Direct email to the security contact on your account. We do not treat a status page as notification.
• Cooperation - We support your own regulator and data-subject notifications, including providing logs and written statements for your filing.

The Am I Being Pwned? Chrome extension reports the following data for each enrolled device:

• A device identifier (set by your organisation or MDM)
• Chrome extension IDs, version numbers, and declared permissions
• Extension enabled/disabled status

What we never collect

• Browsing history or visited URLs
• Form data, keystrokes, or credentials
• Page content or DOM
• Cookies or session tokens
• Screenshots or screen recordings
• Personal files or documents

The Am I Being Pwned? extension requires the management permission to enumerate installed extensions and their metadata. This is the minimum permission required to provide the service.

The extension does not request tabs, webRequest, cookies, or any host permissions. It cannot read or modify web page content.

• Framework mapping - Our security findings and compliance reports map to CIS Controls v8, ISO 27001 Annex A, and SOC 2 Trust Services Criteria.
• GDPR - All data processed and stored within the EU. We collect the minimum data necessary and retain it only as long as needed. See our Privacy Policy for details.
• Data processing - Enterprise customers can request a Data Processing Agreement (DPA) by contacting us.

If you believe you have found a security vulnerability in our service, please report it via our contact form. You can encrypt your report using our PGP key:

We ask that you

• Give us reasonable time to investigate and fix the issue before public disclosure
• Avoid accessing or modifying other users' data during your research
• Include enough detail for us to reproduce the issue

We will not pursue legal action against researchers acting in good faith.