Why does Chrome show “Read and change all your data on all websites” at install?

Because a small content script checks on every page whether a UI5 app runs there – for at most ten seconds, without reading content, without sending anything. FrontTailor gets access to an app only after you grant the domain. Companies can prescribe the allowed hosts via the allowedHosts policy; all others are then blocked.

Does FrontTailor read cookies, tokens or passwords?

No. FrontTailor reads no cookies. Headers with tokens and credentials are not stored in the OData log; exports and saved replays contain no tokens, cookies or authorization headers. The cache reset never deletes cookies or passwords.

Where does the AI key live?

Only if you want it, and then encrypted in chrome.storage.local on the device – never in sync, never in exports, team packages, reports or logs. With the policy ai.persistKeys: false it stays in memory only. The encryption does not protect against someone with access to the whole browser profile. There is no CloudDNA AI proxy.

Can IT switch off individual features?

Yes. Via chrome.storage.managed – by group policy, Intune or Jamf – 27 modules can be switched off individually, hosts allowed, PROD hosts set, the AI assistant pinned to one endpoint or switched off, and licence and team packages distributed. Policies take effect without a reload.

Does FrontTailor need the debugger permission?

No. The CPU deep profile of the performance profiler runs through a separate, free extension, the FrontTailor Profiler Companion. Only it holds the debugger permission. If you do not need the deep profile, you don’t install it.

Security and privacy

May. May not. Written here.

FrontTailor looks into Fiori apps with real data, often on production systems. That only works if it is clear what the extension may do, what it never does and who controls it. Here it is – with sources.

Permissions

Seven fixed permissions, two on request, one never.

This is how they appear in the extension’s manifest. Every further permission needs its own documented decision.

Permission	When	What for
`storage`	always	Your settings, host profiles, saved filters and bookmarks – locally in the browser.
`scripting`	always	After you grant the domain, inject the script that reads the UI5 runtime. Content scripts cannot see UI5; only this script talks to UI5, exclusively through an adapter.
`activeTab`	always	On a click on the icon or a shortcut, use the current tab: system info in the popup, a screenshot of the visible area for “report a problem”.
`sidePanel`	always	The side panel next to the app; it stays open while navigating in the launchpad, even without DevTools.
`webRequest`	always	Observe the OData requests of granted apps for the console – read-only, nothing is blocked or changed.
`alarms`	always	Fetch the team packages IT prescribes by policy, and the optional morning-check reminder. No install warning.
`declarativeNetRequestWithHostAccess`	always	Test a UI5 version from the SAP CDN and local code: redirect in exactly one tab, after a preview, only on granted hosts, locked on PROD. No install warning.
`browsingData`	on request	Only requested at the first browser cache reset. It clears only the cache of the tab’s domain, never cookies or passwords.
`https:///`, `http:///`	on request	Host access only after you grant each domain: “Activate FrontTailor for this host?”
`debugger`	never	Only the separate, free Profiler Companion holds it for the CPU deep profile – if you install it.

The install warning. Chrome still shows “Read and change all your data on all websites”. The reason: a small content script checks on every page, for at most ten seconds, whether UI5 markers are in the DOM. It reads no content, sends nothing and injects nothing. To limit this to your systems, set the allowedHosts policy.

PROD protection

On PROD we read, we don’t change.

Every feature that changes something at runtime is marked as PROD-guarded in the code. The service worker refuses it on PROD tabs before it reaches the page – when in doubt, locked.

ProfileYou decide what PROD is – or IT does. Host profiles have a PROD flag; the prodHosts policy enforces it, and then it cannot be switched off.
Traffic lightRed means PROD. The extension icon turns red as soon as you are on a PROD host.
LockedWhat changes, doesn’t run. Property edit, replay, personalisation reset, cache reset, swapping the UI5 version, fault simulation, local code, synthetic check.
AllowedWhat reads, runs. Inspector, models, OData console, profiler, readiness check, bug report, morning check without recorded steps.

No silent transfer

What FrontTailor sends: nothing, unless you click.

FrontTailor works locally, collects no personal data and transmits nothing to CloudDNA. No telemetry, no analytics, no advertising, no account.

OData logStays locally in the extension’s IndexedDB, without cookies, tokens and credentials, and is deleted when the tab closes.
AI assistantSends only after a preview with endpoint, headers, system prompt and full content and your click – straight to your provider, never to CloudDNA. Answers are never applied automatically.
Tickets and bug reportBy default, your ticket system’s prefilled form opens in a new tab. The extension itself sends nothing; in API mode only after a preview. Tokens live in memory at most.
System comparison and morning checkOnly on click, only against the same server, without business data. No background crawling.
LicenceChecked offline, without a network call.

The full privacy policy of the extension lists every piece of data with purpose, storage location and duration.

Your own AI key (BYOK)

Your key. Your provider. No proxy.

If you want, FrontTailor stores the AI key encrypted in chrome.storage.local – never in sync, never in exports, team packages, reports or logs. Otherwise it stays in memory only.

EncryptedAES-GCM-256 with a non-exportable WebCrypto key. It does not protect against someone with access to the whole browser profile – we say so.
Can be switched offWith the policy ai.persistKeys: false keys stay in memory only; aiEndpoint pins the endpoint, modules.ai: false switches the assistant off.
MaskedE-mail, phone, IBAN and long digit strings are masked before every request; aiRequirePiiMasking enforces it.

For corporate IT

Admin policies via managed storage.

Via chrome.storage.managed – by group policy, Intune or Jamf – IT prescribes what FrontTailor may do. Policies take effect without a reload. The schema ships with the extension as managed-schema.json.

Policy	Effect
`allowedHosts`	Host patterns on which FrontTailor may activate. If set, all other hosts are blocked.
`prodHosts`	Host patterns treated as PROD. The PROD flag cannot be switched off there.
`modules`	Switch off 27 modules individually (e.g. `ai`, `override`, `faults`, `recorder`): tab hidden, the service worker refuses their messages.
`aiEndpoint`, `aiProvider`, `aiAllowedProviders`	Pin the AI endpoint (e.g. your gateway or SAP AI Core), prescribe or restrict providers. An empty endpoint switches the assistant off.
`aiRequirePiiMasking`, `ai.persistKeys`	Enforce masking; keys in memory only.
`licenseKey`, `trial`	Set the licence for all users of the browser; switch the trial off.
`teamSync`	Prescribe team packages, trusted keys, signature requirement, sync interval, allow own packages or not.
`issueReporter`	Targets of the bug report, mandatory masking rules, default repository and recipient.
`ticketTargets`, `allowedTicketHosts`	Preconfigured ticket systems (never with tokens) and allowed ticket hosts.
`telemetry`	Present in the schema, unused in FrontTailor: there is no telemetry.

For machines without the Chrome Web Store, Enterprise includes sideloading as a package. Discuss a roll-out →

Supply chain

No code that gets loaded later.

No remote code, no eval, no source maps in the release, a CSP without unsafe-eval and unsafe-inline. The build is reproducible, and every release ships a CycloneDX SBOM.

Only through the adapterOnly the page script talks to UI5, through an adapter that never throws into the page. If an API is missing in the detected UI5 version, the module switches off instead of showing wrong data.
Openly checkedCodeQL and pnpm audit run in the pipeline; Community is licensed under Apache 2.0.

Sources on this page

The superscript numbers in the text point here. Tap one to see the source right where it is used; all sources of this website are listed on one page.

1
Permissions according to the manifest ↑Product · FrontTailor product documentation, manifest (apps/extension/manifest.config.ts) and store text · checked on 2026-11-09
2
Access only after granting per domain ↑Product · FrontTailor product documentation, ADR-001 “Layered model and messaging” · checked on 2026-11-09
3
PROD lock in the background, fail closed ↑Product · FrontTailor product documentation, ADR-004 “Feature modules” · checked on 2026-11-09
4
Traffic-light badge and host profiles ↑Product · FrontTailor product documentation, ADR-003 “Traffic light, session errors, profiles” · checked on 2026-11-09
5
No data to CloudDNA ↑Product · FrontTailor product documentation, privacy policy of the extension (docs/datenschutz.md) · checked on 2026-11-09
6
AI assistant with your own key ↑Product · FrontTailor product documentation, ADR-018 “AI assistant (BYOK)” · checked on 2026-11-09
7
Report a problem with a masked report ↑Product · FrontTailor product documentation, ADR-017 “Issue reporter” · checked on 2026-11-09
8
Tickets in Jira, GitHub, GitLab, Azure DevOps and ServiceNow ↑Product · FrontTailor product documentation, ADR-031 “Ticket integrations” · checked on 2026-11-09
9
System comparison DEV/QA/PROD ↑Product · FrontTailor product documentation, ADR-030 “System comparison” · checked on 2026-11-09
10
Licence checked offline, key only local ↑Product · FrontTailor product documentation, ADR-014 “Module registry and licence” · checked on 2026-11-09
11
AI key only local and encrypted ↑Product · FrontTailor product documentation, ADR-018 “AI assistant (BYOK), addendum” · checked on 2026-11-09
12
Masking of personal data before sending ↑Product · FrontTailor product documentation, store text (docs/store-listing.md) and ADR-018 · checked on 2026-11-09
13
Admin policies via managed storage ↑Product · FrontTailor product documentation, policy schema (apps/extension/public/managed-schema.json) and ADR-013 · checked on 2026-11-09
14
Supply chain: no remote code, SBOM, reproducible ↑Product · FrontTailor product documentation, ADR-009 and README, section release · checked on 2026-11-09
15
UI5 1.71 to 2.x, SAPUI5 and OpenUI5 ↑Product · FrontTailor product documentation, ADR-002 “UI5 adapter” · checked on 2026-11-09
16
Community edition under Apache 2.0 ↑Product · FrontTailor product documentation, README, section licence · checked on 2026-11-09

Frequently asked

Questions from IT security.

Why does Chrome show “Read and change all your data on all websites” at install?: Because a small content script checks on every page whether a UI5 app runs there – for at most ten seconds, without reading content, without sending anything. FrontTailor gets access to an app only after you grant the domain. Companies can prescribe the allowed hosts via the allowedHosts policy; all others are then blocked.
Does FrontTailor read cookies, tokens or passwords?: No. FrontTailor reads no cookies. Headers with tokens and credentials are not stored in the OData log; exports and saved replays contain no tokens, cookies or authorization headers. The cache reset never deletes cookies or passwords.
Where does the AI key live?: Only if you want it, and then encrypted in chrome.storage.local on the device – never in sync, never in exports, team packages, reports or logs. With the policy ai.persistKeys: false it stays in memory only. The encryption does not protect against someone with access to the whole browser profile. There is no CloudDNA AI proxy.
Can IT switch off individual features?: Yes. Via chrome.storage.managed – by group policy, Intune or Jamf – 27 modules can be switched off individually, hosts allowed, PROD hosts set, the AI assistant pinned to one endpoint or switched off, and licence and team packages distributed. Policies take effect without a reload.
Does FrontTailor need the debugger permission?: No. The CPU deep profile of the performance profiler runs through a separate, free extension, the FrontTailor Profiler Companion. Only it holds the debugger permission. If you do not need the deep profile, you don’t install it.

Your question isn’t here? Talk to me: +43 664 1964199 office@clouddna.at Get in touch