How to use SafePrompt: Balanced, Strict, Undo, Allow once

This is the practical end-user guide. After installing SafePrompt, these are the controls you will actually touch.

1. Install and confirm it is on

1. Add SafePrompt from the Chrome Web Store (coming soon) or load the unpacked build while testing.
2. Pin the extension icon.
3. Open the popup — status should say Protected.
4. Open ChatGPT or Gemini and paste a sample key like AKIAIOSFODNN7EXAMPLE.
5. You should see a toast and the text become [API_KEY].

2. Redact mode vs block mode

• Redact mode (default): replaces secrets with placeholders so your prompt stays usable.
• Block mode: removes sensitive content more aggressively instead of replacing it.

Most users should leave Redact mode on.

3. Balanced vs Strict preset

Balanced (recommended daily)

• Fewer false alarms
• May skip some card-like numbers when invoice/payment context is present
• Best for normal coding and writing

Strict

• More aggressive about card-like numbers even with invoice-style words
• Use when handling payment discussions or sensitive customer data

4. Understanding redaction tokens

• [API_KEY] — access keys and API tokens
• [PII] — email, phone, credit card style data
• [SECRET] — private keys, Bearer tokens, AWS secrets (with context)

5. Toast actions every user should know

Undo

Restores the previous text if SafePrompt redacted something you needed (for example a false positive). Use carefully.

Allow once

Temporarily pauses protection for about 60 seconds and can restore the last blocked text. Use only when you accept the risk.

Dismiss

Closes the toast without changing the redaction.

6. Advanced settings

• Protection on: master switch
• Toast alerts: turn off only if you prefer browser alerts
• Rule toggles: enable/disable specific detectors
• Whitelist phrases: exact phrases that should never be blocked

7. Dashboard numbers

• Detections — how many sensitive items were found
• Redacted — how many were masked/removed
• Allowed — how often you used Allow once

These counts do not store the secret values themselves.

8. First-run onboarding

On supported AI sites, SafePrompt may show a short “Got it” card the first time. That only explains local protection — it does not send data.

9. Troubleshooting for end users

• Nothing happens: reload extension, refresh the AI tab, confirm Protection is on
• Works on ChatGPT but not another site: that site may need a selector update — email us
• Too many false positives: switch to Balanced, adjust rules, or whitelist exact phrases
• Need temporary bypass: Allow once, then turn protection back to normal