Good CodesHow it's built, and what it can and can't do
Browser extensions can be powerful. This one is deliberately not, so here's exactly what you're installing. Every line is published on GitHub.
What you're installing
A small extension: about 650 lines in total (code and page layout), with no third-party libraries. Chrome's current extension rules (Manifest V3) don't let an extension download new code to run, so everything it can ever do is in the files you install.
It never reads web pages. The only thing it ever adds to a page is its own banner, only on listed shops' cart and checkout pages, and only if you've turned alerts on.
The permissions it asks for
None of the basic permissions give it access to your data. Installed from the Chrome Web Store, Chrome shows no warnings for them. (Installing from the zip skips Chrome's permission prompt altogether.)
| Permission | What it allows |
|---|---|
| Declarative content | Hands Chrome the list of shops so Chrome can turn the icon green on them. The extension isn't told which page you're on. |
| Active tab | When you click the icon, it can see the address of that one tab, at that moment, so it can show that shop's codes. |
| Storage | Remembers the shop list and the code you last copied, on your computer. |
| Alarms | Refreshes the shop list every six hours. |
| Scripting | Lets it add its banner to a page. The extension only does that on listed shops when alerts are on. (After you click the icon, Chrome would also let it add to that tab; it doesn't.) |
Only if you turn on alerts, Chrome asks you to allow two more:
| Permission | What it allows |
|---|---|
| Site access ("read and change your data on all websites") | Lets it see each site's address, to check it against the shop list on your computer, and show its banner on listed shops' cart and checkout pages. It doesn't read pages, and other sites' addresses are never sent. Chrome's wording is broader than what the code does, which is why the code is public. |
| Notifications | Asks "did it work?" if you leave a shop before answering. |
You can turn alerts off at any time from the icon, which hands those permissions back. It never asks for your history, cookies, downloads or passwords, and it can't watch or redirect your web traffic.
Built-in safeguards
- It checks what our own server sends. A code has to be plain letters and numbers, shoppers' free-text descriptions aren't shown, and the banner only shows codes that other shoppers confirmed or that the shop published itself. A broken-into server still couldn't read your pages or your other browsing, but it could show wrong or misleading codes and choose which shops count as listed.
- The server checks everything too. Every request is validated and rate-limited, and only the extension (not other websites) can send votes from your browser.
- Harder to game. A code only shows as "works for others" after 👍 from two different internet connections, neither of them the sharer's, and each connection gets one vote per code. Someone with many connections could still cheat, so treat codes as likely, not guaranteed.
- Walled off from the shop's page. The banner lives in a closed part of the page that the shop's code can't read, and it ignores clicks a website fakes. A page's own code could still hide or move it.
- Encrypted. Everything travels over HTTPS, and this site sends strict browser security headers.
- Nothing worth stealing. There are no accounts, passwords or payment details on our side. See the privacy page for exactly what's kept and for how long.
- Hands off affiliate links. It never touches links or cookies on the sites you visit, so the creator who sent you still gets paid.
Where it runs
The website, the code list and the votes run on Cloudflare (Workers and its D1 database), which also handles encryption and protection against attacks.
What's not done yet
We'd rather tell you than have you find out:
- It isn't in the Chrome Web Store yet. Installing it by hand skips Google's review and automatic updates. If you install from the zip, you can compare its SHA-256 fingerprint with the one on the GitHub release.
- It hasn't had an independent security review. We did run our own adversarial review and published the findings and fixes in the repository.
Last updated 18 October 2026.