StackyOps Vault

Single purpose description ▎ StackyOps Vault lets a user sign in to websites using the logins stored in their own ▎ StackyOps account. It matches the site the user is on against their saved logins, and on the ▎ user's action fills the username and password and shows that site's 2FA code; it can also ▎ offer to save a newly entered login back to the vault. It talks only to the self-hosted ▎ StackyOps server the user pairs it with — no third parties. activeTab justification ▎ activeTab is used only when the user clicks the toolbar icon or a Fill/Save action in the ▎ popup. It lets the extension read the current tab's URL to find the matching saved login and ▎ fill it into that page's sign-in form. Tabs are never read in the background. Host permission justification (https://*/*, http://localhost/*) ▎ Host access is optional and granted by the user. It is needed to (1) detect the current ▎ site's domain so the right saved login can be matched and filled, and (2) reach the user's ▎ own StackyOps server. StackyOps is self-hosted, so each user runs it on a different address ▎ (including localhost for local self-hosting); the extension cannot hard-code one host, so ▎ the user grants access to the site(s) they actually use. No data is ever sent to any third ▎ party. scripting justification ▎ scripting is used to fill the user's saved username and password into the sign-in form of ▎ the page they are currently viewing, only when they explicitly click Fill in the popup, and ▎ to read a login form's fields to offer to save a newly typed login. Injection happens only ▎ on user action and only on the active tab. storage justification ▎ chrome.storage.local stores only the extension's own settings: the StackyOps server URL the ▎ user paired with, the device pairing token used to authenticate to that server, the ▎ auto-capture on/off preference, and a short-lived "pending capture" record while a ▎ Save-login prompt is open. It stores no website content and no passwords; vault secrets are ▎ fetched on demand and (for the personal vault) decrypted in memory only. Nothing is synced ▎ anywhere.