laya-browser-guard
Passive Chrome extension that inventories a site's browser-visible attack surface and uses local Laya or Jev to prioritise findings.
Overview
Laya Browser Guard, the Laya Website Security Copilot, is a passive, local-first Chrome extension for developers and authorised security researchers. On click, it inventories a page's scripts, resources, iframes, links, forms and DOM; checks mixed content, insecure scripts, credential and payment form transport, third-party scripts and Subresource Integrity; detects potential secret patterns with automatic redaction; and reviews public security headers such as CSP and HSTS. Every finding gets severity, confidence, evidence, impact and recommended investigation, shown in a popup, an in-page overlay and a dashboard with JSON export.
A deterministic engine does the checks. Optionally, a quantised Laya model (528 MB, downloaded only after user approval, verified by SHA-256 and run with ONNX Runtime Web) interprets the structured evidence with typed decisions, and official Jev decisions are available through a hosted FastAPI gateway. The deterministic engine works when the model is missing. It does not attack the target. An optional research mode allows bounded same-origin JavaScript inspection.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Score | How high a priority is this finding for investigation?(inferred) | — |
| Yes / no | Does this evidence indicate exposed sensitive data or an insecure form?(inferred) | — |
How it works
- User clicks Analyze on a page
- Extension inventories page assets and headers, redacting secrets
- Deterministic checks produce findings
- Optional local Laya or Jev interprets structured evidence
- Findings are fused and shown with recommended next steps
Strengths
- Passive and local-first
- Model optional; deterministic engine always available
- Verified model download and local caching
- Redacts secrets before analysis
Caveats
- For authorised research only
- Model is English-only
- Hosted Jev gateway sends evidence off-device if enabled
Getting started
npm ci && npm run build, then load the dist folder as an unpacked extension in Chrome.At a glance
- Type
- Service
- Status
- beta
- Language
- TypeScript
- Runtime
- Chrome extension (ONNX Runtime Web)
- Has code
- yes
- Has tests
- yes
- License
- Apache-2.0
Use cases and integrations
How curated lists describe it
A passive, privacy-first Chrome security copilot that combines deterministic browser-visible checks with local Laya and official Jev typed decisions. It evaluates redacted evidence from scripts, resources, forms, headers, and DOM signals, then explains investigation priority without attacking the target.
logicrw/awesome-jev-projects
Frequently asked questions
Does it attack websites?
No, it only inspects browser-visible information passively.
Is the model required?
No, the deterministic engine works without it.
Where does inference run?
Locally via ONNX Runtime Web, or optionally through an official Jev gateway.
Related projects
Windows antivirus and EDR prototype that extracts file, process and URL features and asks Jev for verdicts, severity and indicators.
ProjectprototypePythonGo CLI for managing WordPress sites at scale, with typesafe commands that ask Jev questions and a scan --triage that ranks malware findings.
ProjectproductionGoOpen-source link attribution platform whose malicious-link check calls Jev before a short link is created.
ProjectproductionTypeScriptPython/TypeScript/Go chatbot safety library checking user input and bot replies with Jev and returning one actionable verdict per message.
LibraryproductionPythonCisco's security scanner for agent skills, with a System One analyzer as an advisory tier that cannot emit findings or change severity.
Agent skillproductionPythonCLI that scans source, build and CI files with Jev for hidden, deceptive or data-stealing behavior before you run unfamiliar code.
CLIbetaTypeScript