# Is NjectAI safe? Security testing, permissions and password checks

URL: https://nject.ai/docs/security
Last updated: October 20, 2026

> Argon Cyber Security, a Canadian penetration testing company, assessed NjectAI's extension, web app and API in September 2026 against OWASP ASVS Level 1, a subset of the OWASP checks. The extension asks for three permissions and has host access only to NjectAI's own servers, and passwords are stored as hashes and checked against known data breaches.

## Has NjectAI been security tested?

Yes. In September 2026, ethical hackers from [Argon Cyber Security](https://www.argonsecurity.ca), a Canadian penetration testing company, ran an independent security assessment of NjectAI. They tested all three parts of the product: the Chrome extension, the web app with your dashboard, and the API behind both.

| What | Detail |
|---|---|
| Tested by | Argon Cyber Security, Canada |
| When | September 2026 |
| Parts tested | 3: the extension, the web app and the API |
| Standard | OWASP ASVS Level 1, a subset of the OWASP checks |

ASVS is the Application Security Verification Standard from OWASP, the open project behind widely used web security checklists. Level 1 is its baseline level of checks.

The rest of this page covers what the extension can reach in your browser, how your password is protected and what NjectAI logs.

## What permissions does the NjectAI extension ask for?

The NjectAI extension asks Chrome for three permissions. Its host access, the sites it may talk to in the background, covers only NjectAI's own API and web app. It asks for no AI site as a host permission, and it has no global keyboard shortcut.

| Permission | What it allows |
|---|---|
| activeTab | Chrome's standard access to the tab you are on, given only when you click the extension's toolbar button |
| storage | Keeps your sign-in session, your **Nject** and **Autocomplete** switches and your chosen profile in the browser |
| scripting | Picks up your session from the NjectAI sign-in page once you have signed in there |

For how to add the extension, see [How to install NjectAI](https://nject.ai/docs/install).

## Can NjectAI see the other sites I visit?

No. NjectAI's page code runs only on the supported AI sites and on the NjectAI web app, and it does nothing on any other site. It does not ask for the permissions that read your tabs, your browsing history or your cookies.

The supported sites are chatgpt.com, claude.ai, gemini.google.com, google.com, perplexity.ai, grok.com, x.com and twitter.com. On google.com it acts only in Google AI Mode, never on ordinary results or the AI Overview. On x.com and twitter.com it acts only on the Grok page, never in your feed.

On the AI pages, NjectAI does read your chats while you are signed in and switched on: it saves the messages you send and the AI's finished answers to your memory. [NjectAI privacy](https://nject.ai/docs/privacy-and-data) lists exactly what is sent, and how to stop it.

## How does NjectAI protect my password?

NjectAI stores your password only as a bcrypt hash, so the password itself is never kept. A new password needs at least 8 characters, with an uppercase letter, a number and a special character.

When you create an account, set a password, reset it or change it, NjectAI checks it against the list of breached passwords at Have I Been Pwned. Only the first 5 characters of the password's SHA-1 hash leave NjectAI's server, so the password is never sent. A password found in a breach is refused with "This password has appeared in a data breach. Please choose a different one."

You can also sign in with **Continue with Google** and skip the password. Deleting your account needs a 6-digit code sent to your email, valid for 10 minutes. Signing out of the extension or the web app signs you out of both.

## Does NjectAI log my prompts?

When NjectAI's server logs a request to improve or complete a prompt, or a chat it saves, it writes your text as its length, "[REDACTED:n chars]", in place of the words. The log line shows that the request came in and how long its text was. Under the [Privacy Policy](https://nject.ai/privacy-policy), server logs are kept for up to 90 days.

Your prompts are still stored, as memory. While you are signed in and the **Nject** switch is on, each message you send and each finished AI answer go to your NjectAI memory, so NjectAI can draw on them when it improves a prompt or adds your context. That storage is described in full on [NjectAI privacy](https://nject.ai/docs/privacy-and-data), with how to switch it off and what deleting removes.

## How do I report a security issue?

Email info@nject.ai with the subject "Security", as the [Privacy Policy](https://nject.ai/privacy-policy) asks. Describe what you found, the page or part of NjectAI it affects, and the steps to see it again.

## Related

- [NjectAI privacy: what is stored and how to delete it](https://nject.ai/docs/privacy-and-data)
- [How to install the NjectAI Chrome extension](https://nject.ai/docs/install)
- [NjectAI memory](https://nject.ai/docs/memory)