What runs where, what it touches, and how to tell us.

The model, tool by tool

• Browser extension

  Distributed only through the Chrome Web Store and Firefox Add-ons, which review every build. The install prompt will tell you it can read and change your data on all websites, and that is true: its auditing script is declared for every page, because an auditor that cannot see the page cannot audit it. What matters is what is done with that access: audits run locally in the page, results stay inside your browser (its one API permission, storage, holds your settings and each tab's last result), and nothing is transmitted. It is a Manifest V3 extension: it cannot load remote code, so the code the store reviewed is exactly the code that runs.

• Bookmarklet

  A static script served from pour.dev that runs in the page you clicked it on. That is the trust model of every bookmarklet ever made: the same access as pasting into the DevTools console. The audit itself runs entirely in that tab, and the script contains no network calls at all: no fetch, no XHR, no beacons, no websockets. The only request involved is your browser downloading the script when you click.

• Command line

  Drives a local Chromium against the URL you name. The only network traffic is that page load. Results print to your terminal and go nowhere else.

• The engine

  A library with no network APIs anywhere in it. It reads the DOM it is given and returns findings to whichever surface asked.

What leaves your machine

From the tools: nothing. No analytics, no telemetry, no accounts, no crash reporting, no audit results transmitted anywhere. Two honest footnotes so this claim stays exact: uninstalling the extension opens a farewell page on pour.dev (the browser makes that navigation, carrying nothing but the visit itself), and this website uses Google Analytics behind a consent banner, denied by default. The website's analytics never touch the tools.

Check it yourself

Do not take this page's word for any of it. Run an audit with the DevTools network tab open and watch nothing leave. Read the extension's permissions on its store listing before installing. The engine's source is public at github.com/pourdev/pour-engine, and every extension release is published at github.com/pourdev/pour-extension, so a build can be unzipped and inspected before it is trusted.

Working under an NDA or a security policy

Prefer the extension. It is store-reviewed, forbidden from loading remote code, and updates only through the store. The bookmarklet fetches its script from pour.dev at click time, so if your organisation's policy forbids injecting remotely served scripts into client work, that policy is reasonable and the extension is the answer. Managed browsers that disable developer tools typically block all bookmarklets anyway.

Reporting a vulnerability

Email info@pour.dev with "Security" in the subject. Include the surface (extension, bookmarklet, command line, engine, or this website), steps to reproduce, and what an attacker gains. Every report is read, and replies aim to be within five working days. If the bug is exploitable, please give us the chance to fix it before publishing details. There is no bounty programme; there is credit, gratitude, and a fast fix.

In scope: the extension, the bookmarklet payload, the command line tool, the engine, and pour.dev itself. Out of scope: findings on third-party sites that pour merely audited, the inherent capability of a bookmarklet to run script in a page (that is what a bookmarklet is), issues requiring an already compromised browser or machine, and scanner output without a demonstrated impact.

Supported versions

The latest release of each tool. The stores keep the extension current automatically; the bookmarklet always serves the latest build; the command line updates through npm.

First published 19 August 2026 · last reviewed 19 August 2026.