SpotLight

Logo
Presentation
Usage

Inspiration

As Muslims and privacy-conscious citizens, our digital footprint often reveals our most deeply personal values... from prayer time extensions and Quran readers to halal food finders. But in 2024, the cybersecurity community uncovered "BrowserGate": major web platforms were secretly probing user browsers for thousands of installed extensions, including Islamic apps like Deen Shield and PordaAI. Without consent, ad networks and employers could deduce an individual's religion, lifestyle, and private traits in milliseconds. When we looked at existing privacy tools, we found a massive gap: Ad-blockers operate like silent black boxes... they block trackers, but they never tell you what was taken or why. Technical tools (like Wireshark or DevTools) provide deep visibility, but require a degree in cybersecurity to interpret.

We wanted to bridge this gap. We built BeaconLight to act as a transparent privacy glass for the web: it intercepts network traffic, translates complex telemetry into plain English, and lets users neutralize trackers with one click.

What it does :

BeaconLight is an open-source, local-first Manifest V3 Chrome Extension that lives in your browser's Side Panel. It provides real-time observability over whatever website you are currently browsing: Two-Tier Classification Engine: Known trackers (Google Analytics, PubMatic, etc.) are auto-blocked instantly via native network rules. Behavioral threats (fingerprinting, extension probing, PII leakage) are flagged for human review. Contextual Intelligence: It compares the active tab's domain with request destinations to automatically filter out benign first-party app traffic, eliminating false alarms. Smart Spoofing ("Defense by Deception"): Instead of breaking websites by hard-blocking scripts, BeaconLight can inject syntactically valid fake data (like Null Island geolocation coordinates 0.0, 0.0 or canvas pixel noise) so web apps stay fully functional while trackers receive garbage. On-Device AI Explainer: Features an opt-in explainer powered by Chrome's local Prompt API or a deep heuristic semantic parser—keeping 100% of user data on-device.

How we built it :

We built BeaconLight completely from scratch in 24 hours using React 18, TypeScript, and Vite, bundled via @crxjs/vite-plugin. Navigating Google's strict Manifest V3 constraints required an advanced architecture: The Interception Bridge: Because Manifest V3 isolated content scripts from webpage execution contexts, we authored an inline script (inject.ts) injected at document_start into the MAIN world. This monkey-patches window.fetch and XMLHttpRequest.prototype to capture payloads before encryption. The Background Worker: Intercepted payloads are securely messaged to our background service worker (background.ts), which manages the classification engine, 1st/3rd-party attribution, and dynamic declarativeNetRequest rule mutations. The Side Panel UI: A custom-styled, cyberpunk terminal interface built with Tailwind CSS and CSS scanline effects, streaming live traffic via long-lived chrome.runtime.Port connections. Cross-Browser Tooling: We even wrote a custom Node.js post-processing script to strip Chromium-specific manifest tags and generate a 100% compliant Firefox sidebar bundle (dist-firefox/).

Challenges we ran into :

Manifest V3 Isolation Boundaries: Overriding window.fetch inside a content script failed initially because content scripts run in an isolated sandbox. We had to master DOM script injection to bridge the main execution context safely back to our extension. Avoiding False Positives: Our early regex rules flagged standard internal app calls (like Microsoft Outlook fetching user emails) as "PII leaks." We had to engineer a 1st vs. 3rd-Party Contextual Domain Engine to intelligently suppress harmless first-party application traffic. Preventing Website Breakage: Hard-blocking fingerprinting or location scripts crashed interactive map widgets. Solving this forced us to pivot into Smart Spoofing—returning valid mock structures (Null Island coordinates, scrambled canvas alpha channels) that satisfy script execution chains without leaking real data.

What we learned :

Deep Mastery of Chromium Internals: We gained a profound appreciation for Manifest V3 security boundaries, Content Security Policies (CSP), and zero-trust local extension architecture. The Power of User-Centric Privacy: We learned that privacy tools fail when they prioritize technical purity over human usability. Translating raw telemetry into sentences like "This request is reading your device canvas" changes user behavior instantly.

What's next for SpotLight:

WebAssembly Local ML: Integrating a lightweight DistilBERT model via Transformers.js for zero-day obfuscated tracker detection offline. CNAME Cloaking Detection: Unmasking third-party trackers disguised as first-party subdomains via DNS-over-HTTPS inspection. Firefox & Safari Launch: Official publication on the Mozilla Add-ons store and Apple Safari Extension Gallery.