Safe by architecture, private by default

The security model

Six principles, enforced in code — every claim below is implemented and tested.

What that means in practice

• Opaque-origin sandbox — untrusted code can't read your keys, the host page, or call extension APIs.
• Byte-courier, not code-runner — the trusted layer downloads & verifies bytes; it never imports or evals them.
• SHA-pinned dependencies — Python wheels and npm tarballs are verified against pinned hashes before use.
• No SSRF surface — the sandbox sends a package name, never a URL; the host builds every request itself.
• Strict postMessage schema — the host accepts only a known, validated set of messages from the sandbox.
• Sensitive sites excluded — banking, payment and brokerage domains are excluded from content-script injection.
• Human checkpoints — approval is required before payments, submissions, and agent-initiated screenshots.
• Never types into passwords — the agent skips password fields and pauses before destructive actions.
• Zero-dep content scripts — page work uses native browser APIs only.
• No cookies permission — chrome.cookies is unreachable by design.

Privacy by default

There is no Hyperion server. The developer never receives your data — see the full privacy policy.