Subtle Shield

Inspiration

In an era dominated by AI and web-based productivity tools, sensitive data like API keys, financial records, and personally identifiable information (PII) are frequently exposed on-screen during live streams, screen shares, or browser interactions. Existing extensions rely on basic regex or cloud services, which introduce privacy risks. We built SubtleShield to solve this—providing local, real-time data shielding entirely inside the browser.

What It Does

SubtleShield is a privacy-first Chrome extension (Manifest V3) that continuously inspects in-page DOM text and dynamically redacts sensitive content in real time.

Key features include:

On-Device Machine Learning: Runs tiny natural language models locally using Transformers.js and WebAssembly.
Category Toggles: Granular control over API Keys & Secrets, Financial Data, PII, and Private Messages.
Dynamic Sensitivity Adjustment: Customizable detection levels (Low, Medium, High).
Zero Data Leakage: 100% on-device processing—no server calls or data leaving your machine.

How We Built It

Frontend: Next.js, React, Tailwind CSS, and Lucide React for a sleek, dark-themed extension popup interface.
Extension Core: Chrome Extension Manifest V3 architecture with dynamic content script injection.
ML & Inference Engine: Transformers.js coupled with ONNX Runtime and WebAssembly for fast, low-latency client-side text parsing.

Challenges We Faced

Performance Overhead: Running machine learning models directly in browser content scripts without lagging the main page thread.
Manifest V3 Compatibility: Managing async messaging between background scripts, popups, and content scripts while handling non-standard permissions.
Context Loss: Ensuring TypeScript types were strictly respected across Chrome Extension runtime APIs.

What We Learned

How to optimize WebAssembly modules for browser-based machine learning inference.
Best practices for building robust state synchronization within Chrome Extension Manifest V3.
Methods to safely audit and strip sensitive test credentials from deployment pipelines.