INTERNAL REVIEW · 5 OCTOBER 2026
Trenchbun internal security review
Reviewed: 5 October 2026. Extension: 0.33.0. Reviewer: the project's development assistant. This is an internal code review and synthetic test report, not an independent audit, penetration test or certification.
Source availability
Download the reviewed open-source package. It includes the MIT-licensed code, tests, report and file hashes. The GitHub mirror is configured as public, but signed-out access currently returns 404. Its downloaded 95-file tree exactly matched this export. GitHub public visibility remains unresolved.
Scope and evidence
The reviewed extension ZIP has SHA-256 05ef44569fa1d0ed4370888e30a5d18b1db488a64994b51ed3384ad13cd11c32. This export contains its current bundled extension source, the local cloud backend snapshot, pinned Python dependencies, and 37 synthetic security checks. SHA256SUMS.txt records every exported file except itself. This report covers this snapshot; it does not verify the installed Web Store build or the live server's environment.
18 extension security checks and 19 backend security checks passed. Tests use synthetic credentials and mocked network providers. They exercise optional permissions, cleanup on revocation, trusted-message boundaries, fixed request routes, session handling, invitation claims, authentication, quotas and input limits. No trades, real wallet connections or paid provider requests were used. A passing test suite does not establish that every feature works or that all vulnerabilities have been found.
Implementation boundaries observed
- No wallet connection, signing or transaction-submission path was found in the reviewed code. The blockchain transport accepts only
getTransaction,getSignaturesForAddressandgetTokenAccountsByOwneragainst a fixed endpoint. - Terminal access is optional and restricted to explicit Axiom, Terminal and GMGN hosts. There are no mandatory host permissions or static content scripts. Terminal scripts use Chrome's isolated execution world.
- The extension's executable code is bundled. Cloud and public-data request brokers allow fixed routes, require granted permissions, and reject redirects and credentials from the page. AI output is used as text, not executable commands.
- Provider API keys belong on the server. Installation sessions are kept in extension-origin IndexedDB; they are not returned to page scripts. Exact popup sender checks protect invitation and session operations. Backend routes require installation authentication; the extension ID is not sufficient authorization.
- Cloud requests have body limits, quotas and bounded operations. Dependencies are pinned with package hashes. These controls limit exposure; they do not guarantee a fixed provider bill.
Open findings and required follow-up
R1 — Floating controls need independent interaction testing (medium, unresolved). The companion is added to the terminal DOM. A closed shadow root and isolated JavaScript world are not a complete boundary against the page. Input forms use an extension-origin frame, but outer pet, drag, bell and close controls remain in the page event environment. A page's earlier capture listeners may observe events before Trenchbun's propagation guard. Independently test pointer/keyboard propagation, underlying controls, hotkeys, focus, drag and minimization, including a hostile-page harness. Until then, do not claim that accidental terminal interactions are impossible. No direct trade invocation was found; this residual interaction risk has not been ruled out.
R2 — Source/release correspondence (medium, prepared; publication pending). The existing private repository contained extension 0.32.0. This clean export replaces that candidate with the reviewed 0.33.0 files. Publish a fresh reviewed source history rather than exposing the development history, and link a release/tag and exact ZIP hash. The public repository and installed store artifact have not yet been verified against this export.
R3 — Production and distribution verification (medium, unresolved). Independently review the actual Render settings, environment protection, logs, dependency/update process, Chrome Web Store artifact, production extension ID and onboarding. The development installation has been used for cloud connectivity; the store installation needs its own verification. This review intentionally did not read private environment values or user account data.
R4 — Data disclosure and provider controls (medium, unresolved). Reconcile the privacy policy and store disclosures against current chat, positions, watched coins and tracked-wallet requests. Confirm retention/log settings and budget limits with each provider. Confirm the support mailbox receives reports. Synthetic authentication tests do not verify provider retention or account-level billing settings.
Export hygiene
Only allowlisted source, bundled assets, deployment configuration and synthetic security tests are included. Private runtime directories, databases, browser captures, live wallet/account fixtures, developer Git history and environment files are excluded. A pattern scan checks this export for common API credential and private-key formats; it is not an exhaustive secret-detection guarantee. Secret scan results and file hashes are recorded separately.
What this report does not promise
Chrome does not offer a strictly read-only permission for an on-page floating extension. Optional access still permits page modification. Internal checks, open source, store approval and an independent audit can reduce risk, but none guarantees absolute security or a warning-free installation. Independent review has not been commissioned or completed. No live financial-terminal penetration test, supply-chain audit or full feature certification is included here.