1. What this page covers
This page explains what data PayloadPigeon processes, how the local library is protected, and what happens when you send requests, export files or affirmatively opt in to aggregate usage telemetry. The extension, optional telemetry, website, learning Playground, and support enquiries involve different data flows. See the Privacy Policy for details.
2. Data and recipients
| Data | Where / recipient | Control |
|---|---|---|
| Temporary Traffic | Extension session storage | Start, Stop, Clear and the documented Capture lifecycle |
| Saved library | Encrypted local extension storage; some technical metadata remains open | Local password, recovery key, Lock and deletion |
| Website analytics | Cloudflare Web Analytics via Automatic setup | Aggregate website usage and performance only; no advertising or session replay; separate from extension telemetry |
| Optional extension usage telemetry | Cloudflare Workers Analytics Engine | Off by default; affirmative opt-in; aggregate allowlisted counters only |
| Backend Send, Ready and enabled Rules | User-selected server or tested page | Real network or page effects; review the active Test or Rule |
| Downloaded files | User-selected device and later recipients | Readable JSON/Markdown or a package with a separate file password |
| Playground | PayloadPigeon demo service and its infrastructure | Sample data only; page controls and Backend Send can reach its endpoint |
| Website / support | Hosting and email providers | Separate Privacy Policy and contact choices |
3. Permissions
| Permission | Purpose and activation | How it stops |
|---|---|---|
| debugger | Browser-level Capture and modification for the selected tab, including fresh-response handling and network-event verification for supported traffic. | Use Stop for Capture; disable or uninstall the extension to stop its use |
| sidePanel / tabs | Workspace UI and selected-tab context | Closing the panel does not revoke tabs access; disable or uninstall the extension to stop its use |
| storage | Temporary state and saved work | Use the matching Clear, delete or Lock control; uninstall removes extension access |
| unlimitedStorage | Required capacity beyond Chrome’s standard local quota behavior | Used by the installed extension; disable or uninstall it to stop use. Disk space and product limits remain finite |
| Optional HTTP/HTTPS host access | Selected Backend HTTP destination | Revoke the optional site access in Chrome; it is separate from required permissions |
Why PayloadPigeon uses the debugger API
PayloadPigeon uses Chrome’s debugger API because some supported features depend on browser-level network access. It lets the extension work with fresh responses and independently observe supported browser network events instead of relying only on JavaScript wrappers inside the page.
This matters for cases where page-level instrumentation cannot provide the same coverage or verification. Capture remains explicit: you choose the tab, start Capture yourself, and Stop ends the active Capture session.
4. Capture and library lifecycle
Capture is scoped to the browser window where the PayloadPigeon Side Panel is open. Traffic from other Chrome windows is not included in the capture.
| Action | Capture / runtime Traffic | Saved library |
|---|---|---|
| Start capture this tab | Starts selected-tab Capture | Does not create or unlock the library |
| Stop | Ends collection; preserves retained Traffic and Activity | Does not Lock or delete saved data |
| Clear traffic | Deletes temporary HTTP/WS, Actions and Activity after confirmation | Does not delete Tests, Test Plans or Results |
| Last panel closes | Ends Capture after up to 1 s reconnection grace | Does not equal Lock or revoke tabs access |
| Top-level origin changes | Ends the accepted Capture scope | Saved library remains |
| Lock | Ends supported work and clears relevant temporary values, the unlock key and drafts | Keeps the encrypted library |
| Chrome restart / extension reload, update or disable | Requires unlock after the session key is lost | Encrypted library remains |
5. Password, recovery and protection boundaries
Masking hides a value on screen; redaction removes or replaces it in a particular representation; encryption protects saved content with key material. They are not interchangeable. Saved collections use AES-256-GCM before local persistence. In the unlocked state plaintext and key material exist in memory/session storage. Protection does not guarantee physical erasure or defend a compromised OS, browser profile or privileged extension context.
6. Credential modes
| Mode | What it does | Limit |
|---|---|---|
| Current session | Uses an eligible recent captured header from the same context | Stops on missing, ambiguous or mismatched context; no promise for arbitrary body/query credentials |
| Don't send | Omits the selected header | Does not remove cookies or every form of authentication |
| Test value | Stores and sends the chosen literal | Can be a real secret despite its name; use synthetic values |
Cookie, Set-Cookie and Proxy-Authorization are not ordinary editable Test values. Heuristic warnings and evidence sanitisation are separate controls.
7. Exports and sharing
| Format | Protection | Contents / limits |
|---|---|---|
| Standard JSON bundle | Readable plaintext | Selected Plan content; optional history/evidence; not runtime, Advanced Rules or settings |
| Protected package | Separate file password | Recipient previews and explicitly imports into their own protected library |
| Markdown Result | Readable plaintext report | Not an import format; may include selected saved evidence |
The author’s local password/recovery key is never shared as the file password. Import is Protect/Unlock → Choose file → file password if protected → preview/review → explicit Import. Import never starts Capture, Send, Ready or Current Test.
8. WebSocket and page boundary
For the normal supported flow, start Capture, create or connect a compatible page WebSocket, and send a text/JSON message if correlation requires it. PayloadPigeon identifies the connection, after which WebSocket testing becomes available. A WebSocket created after Capture starts does not normally require a page reload. Stop Capture → Start Capture → reconnect is also supported without reload.
A socket created before instrumentation may remain observe-only. Application reinitialisation or reload may be needed if page code cached the native WebSocket constructor before instrumentation. Worker-created, binary-only, unsupported or ambiguously correlated sockets may remain observe-only. Network verified is not a business-success verdict, and Related server message is not simply the next incoming frame. The tested page receives messages intended for it but must not receive unrelated extension data. No exploit details are published here.
9. Playground data notice
Requests and messages that you direct to the Playground endpoint are processed by the PayloadPigeon demo service. This includes the page controls and a Backend Send aimed at that endpoint. HTTP/WebSocket values are kept for the request or connection. Workflow uses in-memory state for up to two minutes and a functional HttpOnly, SameSite client-isolation cookie lasting up to ten minutes; it is not a tracking cookie. Sample fields are not written to a database, KV, files or analytics. See Privacy Policy § Playground for infrastructure handling and the details confirmed for publication.
10. Report a vulnerability
Report a suspected vulnerability privately to security@payloadpigeon.com. Include the PayloadPigeon and Chrome versions, concise reproduction steps, the expected and observed impact, and sample data from a system you own or are authorised to test.
Do not include live credentials or third-party data, and do not use denial of service, social engineering or systems without permission. A bounty, fixed response time or remediation deadline is not promised.