Last updated: 29 July 2026
UnLeak does not collect, transmit, sell, or share any of your data. Everything happens inside your own browser. There is no UnLeak server.
All of the following is saved only in Chrome's local extension storage on your own
computer, using chrome.storage.local:
| Data | Why | Leaves your device? |
|---|---|---|
| Your GitHub personal access token | To call the GitHub API as you | No |
| Your GitHub username and avatar URL | To show who is connected and to check repo ownership | No |
| Repository names and scan timestamps | To show scan status on your repo pages | No |
| Your preferences (private repos, deep scan, banner on/off) | To remember your settings | No |
| A masked preview and a one-way fingerprint of each finding | To display results and remember what you marked as rotated | No |
Full secret values are never stored. A finding keeps only a masked preview
(for example sk_live_4f9…a21) plus a SHA-style fingerprint used to recognise the same
finding on a later scan.
UnLeak makes requests to exactly one place:
https://api.github.com — to list your repositories and read your own commits and
files, authenticated with the token you provided.That is the complete list. No analytics, no telemetry, no crash reporting, no ads, no third-party scripts, no remote code.
The permission for https://github.com/* is optional. On a fresh install UnLeak
requests nothing for github.com. If you turn on the on-page status strip, Chrome asks
your permission, and only then does UnLeak read the owner and repository name from the
page URL — nothing else. It never reads page content. Turn the strip off and the
permission is released.
Open UnLeak, go to Preferences, and choose Disconnect. That erases your token, your account details, and all stored findings immediately. Removing the extension from Chrome also deletes everything.
We recommend a fine-grained or classic personal access token with read-only scope
(public_repo, or repo only if you want private repositories included). You can revoke
it at any time at https://github.com/settings/tokens. UnLeak has no way to use your
token once it is revoked or once you disconnect.
UnLeak's use of information from GitHub is limited to providing the secret-scanning feature described in the Chrome Web Store listing. It is never used for advertising, never sold, never transferred to third parties, and never used to build a profile of you.