Payment Page Script Inventory

Inventory every script on your payment page, with a justification for each.

This extension sends no data to us — we have no server. It does contact the websites you ask it to check, which is how it works. Details below.

What it keeps

A baseline of the scripts found on a page: each script’s address and its SHA-256 fingerprint. It is saved only when you export, so that a later scan can tell you what has changed since.

Anything saved is kept in your browser’s own extension storage on this device, using chrome.storage.local.

What leaves your computer

When you click Scan, the extension fetches each script the page loaded, so it can compute a SHA-256 fingerprint of the exact code. There is no other way to verify that a script has not been altered.

Those requests go directly from your browser to wherever each script is hosted, exactly as the page itself loaded them. Each of those hosts can see your IP address, as they already did when the page loaded.

Nothing about your pages or scans is sent to us, or to any server of ours — we do not have one. The one exception is billing: to run your free trial and subscription, the extension contacts ExtensionPay (extensionpay.com) to read and update your subscription state, and payment itself happens on ExtensionPay and Stripe pages. Your card details go to Stripe, never to us and never through this extension.

The inventory is shown in the popup. When you export, a CSV file is saved to your Downloads folder, on your own disk.

Permissions, and why each one

Permission	Why it is needed
activeTab	To read the scripts on the page you are looking at, and only when you click Scan.
scripting	To run the small function that collects them from the page.
storage	To keep the baseline you export, so a later scan can detect changes — and your subscription and free-trial state via ExtensionPay.
<all_urls> (optional)	Requested at the moment you click Scan, never at install. Fingerprinting a script means fetching it from wherever it is hosted, and those hosts can be anywhere — so the permission has to cover any address. If you decline, the scripts are still listed, but they cannot be fingerprinted.
ExtensionPay (extensionpay.com)	Payments run through ExtensionPay and Stripe. A background worker and a content script that runs only on extensionpay.com manage your free trial and subscription and unlock Pro after you pay. This appears at install as “read and change your data on extensionpay.com.” It runs on no other site, and no card details pass through this extension.

The database of script vendors and their draft justifications ships inside the extension; the fingerprinting happens in your browser. This tool produces the inventory PCI DSS 6.4.3 asks for. It never states that you are compliant — that is your assessor’s judgement, not ours.

Your data, your machine

There is no account, no sign-up and no login. Uninstalling the extension deletes everything it stored. You can also clear it yourself from the extension’s options at any time.

Because nothing is transmitted, there is no copy of anything on any server for us to hand over, lose, or be asked for. That is a deliberate design choice, not an oversight.

Paid features

There are none today — every feature is free, and no payment code runs. If a paid tier is added later, payment would be handled by ExtensionPay and Stripe, who would receive your email and payment details directly. This page will be updated before that happens, not after.

Children

This extension is a professional tool and is not directed at children. It collects nothing from anyone, of any age.

Changes

If what the extension does changes, this page changes first. Every claim here is generated from a single facts file that is kept beside the code, so the two cannot quietly drift apart. The history of this page is public in the repository linked below.

Effective 17 July 2026. Questions, or a correction: shaunpeh@gmail.com.

All privacy policies