Little to explain.
A tool that sees tokens, cookies and logins has to explain itself to the security team. We built AuthTailor so that the explanation is short: no server, nothing stored, access only for a while. Everything else is here – every claim with a source.
- Noserver
No telemetry, no analytics, no advertising, no third-party code.1
- Memoryonly
Recordings and input never on disk2, only while the panel is open.
- Maskedat once
Cookies, Authorization, CSRF tokens, secrets3 while recording.
- Accessfor a while
Host access only when recording, handed back afterwards.4
- Onerequest
The issuer’s public keys, only on click5, without cookies.
Every permission, and what it is for.
The same list is in the extension under “About”, with its current state. None of the fixed permissions triggers a warning at installation.
| Permission | What for | When |
|---|---|---|
storage | Only the UI language and the “Headers” option | always |
sidePanel | Panel next to the page (Chrome, Edge; Firefox uses the sidebar) | always |
webRequest | Live recording, observing only; ineffective without host access | only with host access |
scripting, activeTab | “Scan page storage”: a function runs once in the active tab and reports kind, length and harmless claims, never a value | on click |
https://*/* (optional) | Recording across app, identity provider and API | only on “Record live”, handed back afterwards |
What comes in, what goes out.
The analysis runs entirely in the panel. Only what you copy or save yourself goes out.
- Recording or input. The browser’s requests during a login, or what you paste – messages, tokens, HAR files, certificates, service keys.
- Masked and analysed. Secrets are masked; long cookie values are kept only as a fingerprint, refresh tokens only as a short hash.
- Only on your action. “Copy report”, “Copy headers (masked)”, “Save cleaned HAR” – with masked values only3.
- One request, on click. The issuer’s discovery and JWKS, as a GET without cookies or referrer.
Roll out, restrict, review.
- Roll out.AuthTailor can be installed like any extension through the Chrome and Edge browser policies. There is no configuration of its own and no server that would need to be allowed.
- Restrict.IT can limit or block the optional host access to specific hosts through the browser’s policies; the tracer then keeps working with pasted messages.
- Review.The data flow is above, the permissions in the table, the wording for data protection officers in the privacy policy of the extension. Updates only come through the browser stores.
- Found a vulnerability?Please confidentially to office@clouddna.at. We reply personally.
Sources on this page
The superscript numbers in the text point here. Tap one to see the source right where it is used; all sources of this website are listed on one page.
- 1
No server, no telemetry ↑Product · AuthTailor product documentation, privacy policy of the extension, “In short” · checked on 2026-11-08
- 2
In memory only, while the panel is open ↑Product · AuthTailor product documentation, privacy policy of the extension · checked on 2026-11-08
- 3
Masked as it is recorded ↑Product · AuthTailor product documentation, privacy policy of the extension, masking · checked on 2026-11-08
- 4
Permissions and host access ↑Product · AuthTailor product documentation, README, “Privacy and permissions”; Chrome Web Store materials · checked on 2026-11-08
- 5
The one request: public keys on click ↑Product · AuthTailor product documentation, privacy policy of the extension · checked on 2026-11-08
Questions about security.
- Does CloudDNA see my tokens or recordings?
- No. There is no CloudDNA server, no telemetry and no analytics tool. The analysis runs in the panel on your device; recordings and pasted content stay in memory only while the panel is open.
- Why does the browser ask for access to all websites?
- Because a login runs across several hosts – app, identity provider, API – and the recording has to see all of them. The access is optional, requested only when you click “Record live” and handed back when you stop.
- What leaves the panel?
- Only what you copy or save yourself – such as the report, the masked headers or a cleaned HAR. These contain masked values only. The one outbound connection fetches a token issuer’s public keys when you click.
- Can our IT roll AuthTailor out centrally?
- Yes, like any extension through the Chrome and Edge browser policies. They also let you define the hosts on which the extension may run. Talk to us if you want support with that.
- How do I report a vulnerability?
- Please confidentially to office@clouddna.at, subject “Security AuthTailor”. We reply personally and credit you, if you wish, once the issue is fixed.
Your question isn’t here? Talk to me: +43 664 1964199 office@clouddna.at Get in touch