---
title: "Auditing AI Chrome extensions on private GitHub, GitLab, and internal codebases."
description: "How software engineers and AppSec teams audit AI browser extensions for reading documentation, public open-source repos, and internal pull requests without leaking secrets."
canonical_url: "https://vezz.me/permissions/github-and-source-code-privacy/"
type: "pseo-permissions"
category: "permissions"
topic: "Engineering Security Audit"
intent: "Best for software developers and security engineers who want to use AI reading tools safely without exposing `.env` secrets or entire repositories."
---

# Auditing AI Chrome extensions on private GitHub, GitLab, and internal codebases.

How software engineers and AppSec teams audit AI browser extensions for reading documentation, public open-source repos, and internal pull requests without leaking secrets.

> **Best fit:** Best for software developers and security engineers who want to use AI reading tools safely without exposing `.env` secrets or entire repositories.

## Technical Permission Audit

- **Manifest Key:** `Selection-Scoped Context + Zero Repo OAuth`
- **Chrome Install Warning:** No GitHub OAuth token requested
- **Risk Level:** Medium

```json
// Safe Developer Configuration in Vezz me:
// - Public Docs (MDN, AWS,OSS): Context Level = "Detailed"
// - Internal Repos / PRs: Context Level = "Minimal" (sends ONLY selected lines)
```

### Legitimate Uses
- Explaining complex regexes, SQL queries, compiler errors, or third-party SDK methods in the browser
- Summarizing public open-source GitHub issue discussions and RFCs

### Red Flags to Watch For
- Browser extensions that ask for a `repo` OAuth token to clone or index your private GitHub repositories
- Extensions that scrape hidden DOM fields containing API keys or environment variables in CI/CD dashboards

**How Vezz me handles this:** Vezz me never asks for GitHub OAuth permissions, never reads unselected tabs, and provides a 'Minimal' context toggle that sends strictly the exact lines of code you highlighted.

## Step-by-step workflow

1. **Verify zero GitHub OAuth scope access**: A browser reading tool does not need a GitHub OAuth token (`repo`, `read:org`)—it only needs the text you highlight on screen.
2. **Use Minimal context on proprietary code**: When you highlight a 5-line regex or SQL snippet inside an internal repo, Minimal context guarantees the rest of the file is not included.
3. **Never highlight hardcoded secrets or tokens**: Just as with any AI tool, never highlight live API keys, bearer tokens, or private keys.

## Why selection-scoped browser tools are easier to audit than full repo indexers

With a selection-triggered extension like Vezz me, the engineer controls the exact character boundary of every query.

- You see the exact highlighted text before pressing `Ctrl+Shift+X`
- Zero background indexing of your codebase or browser tabs
- All extension client code is static, unminified Manifest V3 JavaScript that your security team can inspect in 5 minutes

## Frequently asked questions

### Can my AppSec team inspect Vezz me's source code before approving it?

Yes. Because Vezz me uses zero remote code execution and ships readable JavaScript in its Chrome Web Store / Firefox Add-on package, any security engineer can inspect its exact API payload in Chrome DevTools.

## Related guides

- [AI Chrome extension for GitHub](https://vezz.me/for/github/): Platform guide for using Vezz me on github.com.
- [Vezz me for Software Developers](https://vezz.me/for/software-developers/): Complete developer workflow guide.