Chrome Extension Source Viewer - X-Ray

⚡ WHAT'S NEW IN v1.0.3: • 🚀 Instant Guest Mode: Try 1 full extension teardown immediately upon install — no signup or login required! • 🎰 Daily Lucky Spin: Spin the wheel every day at midnight (00:00 UTC) to win free AI Decompiles, Deep Architecture Specs, and Jackpots. • 🧠 Gemini Flash-Lite AI Decompiler: Reverse-engineer obfuscated variables and minified code into clean, readable JavaScript. • ⚡ 0ms Smart Local Cache: Cached extensions load in zero latency with zero network bandwidth. • 🛡️ Strict Privacy: Security audit and reverse engineering happen directly inside your browser. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Chrome Extension Source Viewer - X-Ray is a next-generation developer inspection suite and security audit tool built natively for Chrome's Side Panel. View, explore, and analyze extension source code, CRX/ZIP packages, manifest declarations, permissions, and network APIs in real-time without leaving your current tab. Whether you are auditing an extension before installation, reverse-engineering architecture, verifying Manifest V3 compliance, or scanning for exposed credentials, Extension X-Ray delivers instant, sandboxed transparency. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ⚡ CORE CAPABILITIES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔍 1. Real-Time Source Code Inspection • Instant Source Exploration: Inspect any extension directly from the Chrome Web Store, by extension ID, or via local drag-and-drop (.crx or .zip). • Full-Featured File Tree: Navigate directories, background scripts, content scripts, and HTML/CSS assets with Monaco-grade syntax highlighting. • Deep Search & Regex: Filter and search across all files in the package instantly. • Offline Export: Download clean, uncompressed ZIP archives for offline code review in VS Code or your favorite IDE. 🛡️ 2. Security Audit & Secret Scanner • Leaked Credential Detection: Scans source code for accidentally committed API keys, tokens, webhooks, and private certificates using entropy analysis. • Attack Surface Mapping: Highlights sensitive API calls, dynamic evaluation (`eval`), and externally reachable listeners. • Cryptographic Integrity: Validates SHA-256 file hashes to verify package authenticity. 📋 3. Permission & Host Access Analyzer • Detailed Permission Breakdown: Categorizes requested permissions into Safe, Elevated, and High-Risk. • Broad Host Pattern Flags: Warns against excessive host permissions (`<all_urls>`, broad wildcards) that could compromise user browsing sessions. • Data Exfiltration Warning: Flags potential tracking vectors and unverified third-party endpoints. ⚡ 4. Manifest V3 Compliance & Network Audit • Modern MV3 Diagnostics: Detects deprecated background page patterns, blocking webRequest APIs, and non-declarative rule usage. • Network & Domain Mapping: Identifies external endpoints, analytics domains, CDNs, and backend endpoints embedded in scripts. • CSP Verification: Audits Content Security Policy headers to detect loose scripting rules. 📐 5. Architecture & Clean Rebuild Blueprint Generator • Decompilation Specs: Generates structured architectural blueprints and component breakdowns. • Developer Modernization: Get prompt-ready prompts to refactor legacy extensions into clean, modern Manifest V3 standards. 🚀 6. Instant Guest Mode (Try 1-Click Free Teardown) • No Sign-in Barrier: New users can test and perform 1 complete extension teardown immediately upon installation without signing in. • Frictionless Audit: Paste any Chrome Web Store link or upload a CRX/ZIP to get instant security insights. 🎰 7. Daily Lucky Spin & Free AI Credits • Midnight Reset: Spin the wheel every day at 00:00 UTC for free AI Decompiles and Deep Architecture Specs. • Fair Rewards: Daily engagement rewards for active developers. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔒 PRIVACY & SANDBOXED SECURITY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ • 100% Client-Side Processing: Code decompression, parsing, and AST audits run strictly inside your client browser sandbox. • Zero Telemetry: No browsing history, inspected source files, or credentials are ever recorded or transmitted. • Safe Inspection: Inspect extensions safely without executing their background scripts or injecting untrusted code into your web pages. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🚀 HOW TO USE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. Click the Extension X-Ray icon in your Chrome toolbar or right-click any page and select "Inspect with Extension X-Ray". 2. The Side Panel opens automatically alongside your active tab. 3. Browse the file hierarchy, analyze permissions, audit security scores, or export the ZIP package with one click. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ⚠️ DISCLAIMER ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Chrome Extension Source Viewer - X-Ray is an independent developer and security audit tool created for educational, analytical, and security auditing purposes. This extension is not affiliated with, endorsed by, or sponsored by Google LLC or the Chrome Web Store. All product names, logos, and brands referenced are property of their respective owners.