How it works
How Riidact checks a message before it sends.
Riidact is a browser extension that checks each message before it leaves your device. The checks run in your browser, on the text as you write it. This page walks through how, piece by piece.
Step by step
What runs between typing and sending.
Say a message has a live API key in it. Four things happen before it can send, and all four run locally, in a few milliseconds.
- 01
It reads the box
The extension watches the text you're composing, in the page, the way a spell-checker would.
- 02
Three checkers look at once
The pattern library, the on-device model, and your own rules all scan the same text in parallel and hand back what they found.
- 03
The risky bit is held
Anything flagged gets underlined right where it sits, and the send pauses so you can decide: remove it, or send anyway.
- 04
Only a receipt leaves
If you're signed in, a metadata receipt syncs to your dashboard. The words themselves stay on your machine.
The three checks
Three checks run on every message.
A credential has a recognisable shape; a person's name does not. Riidact runs three kinds of check so it catches both, and each one runs on your device.
Patterns it knows on sight
A library of 200+ credential formats, built on Gitleaks (the open-source secret scanner), plus government, tax and health ID formats for 55+ countries. Where a number carries a check digit, Riidact runs the same maths the issuing country uses before it flags anything.
A small AI model, in your browser
Some things have no fixed shape, like a person's name or a place. A compact model reads those the way a person would. It downloads once (about 110 MB), lives in your browser's cache, and runs locally. It never talks to a server.
The words that matter to you
A client nobody's announced yet, the shape of your invoice numbers, an internal hostname. Describe them once and they sync down to the extension, matching locally everywhere you type.
Precision
Telling a real ID from a stray number.
Most numbers in a message aren't sensitive. Riidact uses the words around a number, and its check digit where one exists, to decide whether it's a real ID before flagging it.
It reads the context
A number on its own is left alone. The same number next to a label like “SSN” is caught. A matching check digit raises confidence but never flags a bare number on its own.
It's tested against look-alikes
Detection changes run against a fixed set of text that looks sensitive but isn't: order numbers, invoice lines, revenue figures. A change that flags any of them doesn't ship.
“order 540684321 shipped” · stays silent
On your device
Where each piece lives.
Four kinds of data are involved in a check. Here is where each one is stored.
The AI model's weights
Downloaded once, then cached by your browser and reused from there.
Your watchlist rules
Synced down to the extension and matched locally, like everything else.
Your catch history
One metadata receipt per catch on your dashboard: category, severity, rule. Never the text.
The words you type
Nowhere. They're checked in the page and never transmitted.
What it's built on
The pieces behind the detection.
Riidact's detection combines several open-source projects with our own recognizers. Each one is listed below. The country ID set, 150+ recognizers, is ours.
What it does
Built on
Finds keys, passwords and secrets, using 200+ known credential patterns
Gitleaks, the open-source secret scanner
Reads people's names and places in 85+ languages, entirely in your browser
Our own multilingual name model, run with Transformers.js and ONNX Runtime
Pulls text out of screenshots and photos on your device
PaddleOCR
Reads PDFs on your device before they'd upload
pdf.js, the PDF reader built for Firefox
Checks phone numbers against real country dialling plans
libphonenumber, Google's phone number library
In short
All of it runs in your browser.
The pattern library, the model, and your own rules all run inside the extension. The text you write is checked where you type it and is never sent anywhere.