NoEgressBadge

Who it's for

Privacy-focused extension developers and MSPs vetting browser extensions; today they cope with DevTools network tab, Wireshark captures, and manifest permission reviews.

The problem

Time and legal: each privacy claim requires hours of manual capture per release, and an unsupported no-egress claim risks GDPR complaints, store review delays, or enterprise procurement rejection.

How to build it

Web upload plus CLI/GitHub Action: submit a .crx or .xpi and a YAML allowlist, get JSON egress log, PDF certificate, and embeddable badge.

How it makes money

Extension vendors and MSPs pay $29-$99 per month for per-release certificates and CI checks because a signed egress report shortens store/enterprise review; free DevTools is manual, non-reproducible, and lacks a signed audit pack.

Why it doesn't exist yet

Incumbent browser vendors and stores check declared permissions and malware, but avoid reproducible runtime privacy attestation across ecosystems; the indie gap is a neutral fenced runner that outputs public signed receipts without needing store privileges.

First users

First users come from privacy-extension authors on Mozilla Add-ons and Chrome Web Store who need a public answer to 'does this phone home?', and from MSPs validating extensions before enterprise policy rollout.

Build size

1 person x 8 weeks; includes headless Chrome/Firefox runner, proxy network capture, allowlist verdict, JSON/PDF certificate, and GitHub Action status check; excludes static source-code audit, store publishing, and non-browser app scanning.

Biggest risk

Concrete kill event: Mozilla or Chrome ships a native store-required extension network-behavior report, or major private-browsing vendors publish their own certification, removing the need for an indie badge.

Conditions for a hit (all 3 required)

• Accepts one packaged extension (.crx/.xpi) and a YAML allowlist of hosts, then returns a JSON log of every observed network request, including URL, initiator, and bytes, within 10 minutes.
• Produces a PDF certificate containing the SHA-256 of the extension file, the SHA-256 of the test allowlist, and a pass/fail verdict.
• If any request goes to a host outside the allowlist, the report lists the exact host, request count, and first/last timestamps; otherwise it states zero non-allowlist egress.

How it's judged (in 6 months)

A GitHub repo explicitly producing signed browser-extension runtime no-egress certificates reaches 800 stars, or a Product Hunt launch for such a service reaches daily top 5.(judgment date 2027-03-20)

AI self-confidence 48/100 — self-reported likelihood of meeting the criterion, not a business success rate