PromptShield

Problem

People paste into ChatGPT the same way they paste into Notes. Credit cards, Social Security numbers, API keys, and passwords go out with one Enter.

Once that text hits the model, you do not get it back. PromptShield is a last chance to stop the send.

What I built

PromptShield is a Manifest V3 Chrome extension I published on the Chrome Web Store. It injects into chat.openai.com and chatgpt.com, scans the prompt and pastes, and blocks submit when it finds sensitive data.

Detection covers six categories: Luhn-validated credit cards, Social Security numbers with area/group/serial checks, phone numbers, emails, API keys (OpenAI, AWS, GitHub, Stripe, Slack, and similar prefixes), and plaintext passwords.

A warning overlay names what was found. You can go back and edit, or redact and send. Categories toggle in the popup. A status badge on the page shows whether protection is on.

How it works

The detector is a local pattern engine. Cards have to pass Luhn. SSNs reject 000, 666, and 9xx area numbers, plus all-zero groups and serials. Keys match known prefixes rather than any long token.

The content script intercepts Enter (without Shift) and send-button clicks in the capture phase, before ChatGPT handles them. Paste is scanned the same way. ChatGPT's input is a contenteditable prompt box, not a quiet textarea, so read and write have to speak both DOM shapes.

Redaction replaces matches with labeled placeholders and re-submits. Nothing leaves the machine. There are no analytics, no tracking, and no network calls from the extension.

Challenges

ChatGPT's DOM moves. The script has to find #prompt-textarea, a contenteditable, or a textarea, and a send button by test id or aria-label. Tight selectors die. Loose selectors fire on the wrong control.

Interception has to win the event race. Listening in capture, and using a processing flag so redact-and-send does not recurse, was the difference between a block and a no-op.

False positives make people uninstall. Luhn and SSN structure rules exist so a long number is not treated like a card. The remaining tension is emails and phones, which are sensitive in some prompts and the whole point of others, which is why categories are toggleable.

Impact

The extension is published on the Chrome Web Store, so protection is an install rather than a developer-mode load.

The privacy claim is the product. If PromptShield uploaded prompts to score them, it would be another place to leak. Local patterns are slower to evolve and safer to trust.

What I learned

A content script on a site you do not own is a contract with someone else's markup. Defensive queries and capture-phase listeners are the job, not polish.

Security UX has to offer a path through the block. Redact and send keeps the workflow. A dead-end warning trains people to disable the tool.

Zero data collection is a design constraint. It ruled out a server-side model and forced the detector to be boring, inspectable JavaScript.