How it works

Kasbah is a browser extension with a built-in detection engine. Everything happens inside your browser. Nothing leaves your device.

The flow, start to finish

Install the extension

Add Kasbah to your browser in one click. The extension starts watching immediately — no extra downloads, no background process, no setup. Thirty seconds and you're protected.

You work normally

ChatGPT, Claude, Gemini, Gmail, Notion — everything behaves exactly as before. Kasbah sits silently in the background watching for 6 moments: send, paste, upload, edit, browse, download.

Something risky happens

You're about to paste database credentials into ChatGPT. The extension intercepts the action — before it completes — and runs the detection engine right there in the browser. This takes under 10ms. The text never leaves your device.

You get a response

Kasbah produces a risk score from 0–100. Under 40: silent, action goes through. 40–69: small warning toast. 70+: a modal stops the action and shows exactly what was found. You decide what happens next. Always.

The three responses

Kasbah doesn't interrupt you for everything. It scales its response to the actual risk level.

How each response looks

Hello, can you help me write a cover letter?

→ silent

My phone is 555-382-9021, can you add it to the doc?

⚠ Heads up — possible phone number. Proceeding.

AKIA4HFKS82JDKSL93PQ — debug this S3 config

🛡 Kasbah blocked this

Found: AWS access key

Proceed anyway

Block — Stay Safe

Score 0–39

Silent — action goes through

You paste a question into ChatGPT or type out a task. Kasbah sees it, checks it, and gets out of your way. Nothing appears. Everything works. This is the most common outcome by far.

Score 40–69

Toast — heads-up, you decide

Something borderline — partial credentials, high-entropy strings, keyword patterns that could be sensitive. A small notification appears in the corner: what was found, a suggestion. The action still proceeds unless you stop it. Non-blocking, informational.

Score 70–100

Block — modal stops the action

A credit card number, API key, SSN, private key, database credentials. The action is held. A modal shows exactly what was found ("Found: credit card number; AWS access key"). Two buttons: Block (stay safe) or Proceed Anyway. You always have final say.

What it looks for

The detection engine combines entropy analysis, pattern matching, and keyword scoring. These are the categories it covers:

High-risk — triggers a block

Credit cards Social Security Numbers API keys (AWS, GitHub, OpenAI) Private keys (RSA, PEM, SSH) Database connection strings JWT tokens Passport files

Medium-risk — triggers a toast

Phone numbers Email addresses in bulk Password assignment patterns High-entropy strings Bearer tokens Prompt injection attempts Shell commands (rm -rf, DROP TABLE) Sensitive filenames (9 languages)

What Kasbah doesn't do It doesn't read your screen, log keystrokes, monitor browsing history, or send anything to our servers. The only content it ever sees is the text or file you're about to submit — and only at that moment. Audit logs are stored locally, encrypted, owned by you.

Common questions

Does Kasbah slow things down?

No. Detection runs in under 10ms on-device. You won't notice any delay, even with long inputs. It was built specifically for zero-latency interception.

What if it blocks something that's fine?

You can always click "Proceed Anyway." Kasbah doesn't lock you out. It asks a question. You have the final answer.

Does it work when I'm offline?

Yes. All detection is local. You don't need an internet connection for Kasbah to work. (You do need one to actually use a cloud AI tool, of course.)

Which sites does it cover?

ChatGPT, Claude, Gemini, Copilot, and most AI tools by default. It also works on Gmail, Slack, Notion, GitHub — essentially any site you paste into. You can configure which sites it watches.