I shipped a Chrome extension, then found a permission bug and a hidden analytics call in the same week
The problem I was scratching Every time I was debugging a web app, the same friction kept happening: I'd see a request in Chrome DevTools' Network tab, and to actually test a variation of it — a different header, a different body, a different query param — I had to copy it out to Postman or Insomnia, paste it in, re-add auth headers, and lose all the DevTools context in the process. Small…
I developed a Chrome extension called Network Sniper to simplify debugging web applications by providing an editable, resend-capable request panel within DevTools. This extension eliminates the need to switch between tools and offers local-first design with no telemetry or cloud sync. When I launched Network Sniper, it received minimal attention, with only 15 installs after launch.
Surprise #1: I initially requested excessive permissions. My first version asked for broad access to all websites, which was inconsistent with the tool's trustworthy, local-first promise. I fixed this by requesting permission only when the user needed it for a specific origin. This change removed the scary warning message displayed by Chrome.
Surprise #2: Despite claiming zero telemetry, my extension contained a hidden Google Analytics property. This discrepancy was discovered during a full code audit, as the Developer Dashboard allowed linking a Google Analytics property for tracking listing page views. I added a regression test to scan the source tree and build output for analytics domains and SDK signatures, ensuring the extension remains telemetry-free.
Network Sniper is now live, permission-minimal, and genuinely does not transmit any data. While growth is slow, the launch highlights the importance of shipping a product and the challenges of growing an audience beyond initial exposure.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
