Extension security today is either an enterprise platform behind a demo call or a Chrome-only checker installed as yet another browser extension. Guard is neither: a free CLI that scans Chrome, Firefox, and Edge locally, checks each extension against 300,000+ listings analyzed with real code scanners + LLM trust scoring, and removes or disables the risky ones — with undo.
No reviews yetBe the first to leave a review for Extenshi.io guard - protect your money
Maker
📌
Hi everyone, I'm Maksim — solo founder of extenshi.io.
Guard started from an uncomfortable observation. I run a cross-browser extension catalog: we track ~308,000 live listings and run security scanners over them continuously. Every time another malicious-extension campaign hit the news, I'd look at our own data and see the same pattern — extensions people have trusted for years quietly change owners, permissions, or behavior. And yet the only tool most of us have for this is chrome://extensions: a list with on/off switches or silent Chrome interventions.
So I built the tool I wanted for myself: one command that finds every extension across the Chrome, Firefox, and Edge profiles on your machine, checks each one against our catalog and scan results, and walks you through removing or disabling the risky ones — reversibly, with undo.
The hardest part wasn't what I expected. Running the scanners was the easy bit — calibrating them was the real work. Point a stack of security scanners at hundreds of thousands of extensions and you get a firehose of findings, and most of them are noise: minified bundles that look like obfuscation, analytics SDKs that look like exfiltration, a permission that's alarming in one extension and completely legitimate in another. Months went into tuning rules, cutting false positives, and adding an LLM layer that judges whether the permissions an extension asks for actually match what it claims to do. A tool that flags everything is as useless as one that flags nothing — the whole product is in that judgment.
I'm a one-person company, and a lot of this was built working alongside AI agents. Happy to share details about that workflow if anyone's curious.
Privacy was a hard constraint from day one: only extension IDs ever leave your machine. Never names, file paths, or browsing data.
One ask: I'm exploring a Teams/Org version — the same scan across a whole company, with weekly risk reports for IT teams and MSPs. If you manage other people's browsers and this sounds useful (or useless!), I'd genuinely like to hear why.
Try the scan and tell me what it found.