Browser extension: what the DLP scan covers
See Browser Extension for installation and how rules sync.
Which ways of getting text into an AI chat the Control Zero browser extension scans, and which ones it does not.
This page is published from a page generated from the extension's own coverage declarations, and those declarations are asserted against measured behaviour: a conformance suite drives every cell below through the real site adapter, the real scanner and the real send gate, and fails if a cell scans when it says it does not, or stops scanning when it says it does. So the generated page this one is published from cannot drift into a claim the code does not back, in either direction. This published copy reflects that generated page as of 2026-09-17; it is not re-checked automatically, so if it ever disagrees with the extension's behaviour, the extension is authoritative.
Read the cells, not the headline. The states are materially different:
- Blocked (
SCANNED_BLOCKING) -- The payload is presented to the DLP scanner and a block rule stops the egress event before the text leaves the page. - Scanned, not blocked (
SCANNED_ADVISORY) -- The payload is presented to the DLP scanner and recorded, but this path cannot stop the egress event. Detect-and-advise; never described as protected. - Not scanned (
NOT_SCANNED) -- The payload is never presented to the DLP scanner. It is neither blocked nor recorded, so its absence from your audit log is not evidence it did not happen. - No such path (
NOT_APPLICABLE) -- This surface has no such injection mechanism, so there is nothing to scan.
Not scanned is the state that matters most and the one easiest to mistake for the other two. Nothing appears in your audit log for an unscanned path, so a clean log is not evidence that nothing left.
Coverage by site and entry path
These are the sites the extension loads on. Nothing else is in scope: the extension has no content script on any other page.
| How the text gets in | ChatGPT | Claude | Gemini | Perplexity |
|---|---|---|---|---|
| Typed into the composer | Blocked | Blocked | Blocked | Blocked |
| Pasted from the clipboard | Blocked | Blocked | Blocked | Blocked |
| File attached to the prompt | Not scanned | Not scanned | Not scanned | Not scanned |
| Dragged and dropped onto the page | Not scanned | Not scanned | Not scanned | Not scanned |
| Written into the composer by the page or another extension | Blocked | Blocked | Blocked | Blocked |
| Editing and resending an earlier message | Not scanned | Not scanned | Not scanned | Not scanned |
| Dictated by voice | Blocked | Blocked | Blocked | Blocked |
Counted across 4 sites and 7 entry paths, 28 cells in total:
- 16 of 28 -- Blocked (
SCANNED_BLOCKING) - 0 of 28 -- Scanned, not blocked (
SCANNED_ADVISORY) - 12 of 28 -- Not scanned (
NOT_SCANNED) - 0 of 28 -- No such path (
NOT_APPLICABLE)
What these results depend on
A status above says what happens while the extension is attached to the page. Some paths reach the scanner only through that attachment, and the attachment is made with selectors written against a site we do not control. When one of these conditions fails, the affected paths are unscanned even though the cell still reads as covered -- so each condition names the signal you can watch for it.
- Typed into the composer, Written into the composer by the page or another extension, Dictated by voice -- These three paths reach the scanner only while the extension has bound the site's composer element. A host-site redesign that no adapter selector matches leaves them unscanned until a new extension build ships.
Detectable as the audit record
dlp_composer_not_bound, and the extension stops reporting itself as enforcing for that page.
Why each result is what it is
Every cell above carries a reason. Reasons are listed here once, with the entry paths that cite them.
Blocked
- Typed into the composer; Dictated by voice -- The adapter's input observer scans the composer as the text arrives, and the send gate re-scans and cancels the send event.
- Pasted from the clipboard -- The paste handler scans the clipboard text synchronously inside the paste event and cancels it, so the text never reaches the page.
- Written into the composer by the page or another extension -- Script-written text raises no input event, so the as-you-type overlay stays silent, but the send gate reads the composer again at send time and cancels the send.
Not scanned
- File attached to the prompt -- The extension reads composer text and clipboard text. It does not open attached files, so nothing inside the file is ever presented to the scanner.
- Dragged and dropped onto the page -- The extension installs no drop handler. A dropped file is never read, and dropped text is only caught later if the page itself turns it into composer text that the scan loop sees.
- Editing and resending an earlier message -- The adapter mounts on the main composer only. The edit box a site opens on an already-sent message is a different element, so no scan loop and no send gate are attached to it.
What each entry path means
| Entry path | Meaning |
|---|---|
| Typed into the composer | Characters entered with the keyboard into the site's prompt box. |
| Pasted from the clipboard | A clipboard paste into the prompt box. Decided synchronously inside the paste event, before the page receives the text. |
| File attached to the prompt | A document, spreadsheet, image or archive attached through the site's file picker. The extension never reads the file's bytes. |
| Dragged and dropped onto the page | A file or a text selection dropped onto the composer. Reported at its weakest guaranteed outcome: a drop carries files as well as text, and a dropped file's bytes are never read. |
| Written into the composer by the page or another extension | Composer text set by script rather than by a keystroke -- a prompt template, a browser autofill, a userscript, another extension. |
| Editing and resending an earlier message | The in-place editor these sites open on a message you already sent. It is a different element from the main composer. |
| Dictated by voice | Speech-to-text delivered into the composer as a dictation input event. |
Sites in scope
| Site | Pages the extension loads on |
|---|---|
| ChatGPT | https://chatgpt.com/*, https://chat.openai.com/* |
| Claude | https://claude.ai/* |
| Gemini | https://gemini.google.com/* |
| Perplexity | https://www.perplexity.ai/*, https://perplexity.ai/* |
Adapters not loaded on any site
The extension carries the adapters below in its code, but no shipped page matches them, so they do not run for anyone. They are listed so the count above is not mistaken for the whole file.
| How the text gets in | Generic fallback adapter |
|---|---|
| Typed into the composer | Not scanned |
| Pasted from the clipboard | Blocked |
| File attached to the prompt | Not scanned |
| Dragged and dropped onto the page | Not scanned |
| Written into the composer by the page or another extension | Not scanned |
| Editing and resending an earlier message | Not scanned |
| Dictated by voice | Not scanned |
Blocked
- Pasted from the clipboard -- The paste handler scans the clipboard text synchronously inside the paste event and cancels it, so the text never reaches the page.
Not scanned
- File attached to the prompt -- The extension reads composer text and clipboard text. It does not open attached files, so nothing inside the file is ever presented to the scanner.
- Dragged and dropped onto the page -- The extension installs no drop handler. A dropped file is never read, and dropped text is only caught later if the page itself turns it into composer text that the scan loop sees.
- Editing and resending an earlier message -- The adapter mounts on the main composer only. The edit box a site opens on an already-sent message is a different element, so no scan loop and no send gate are attached to it.
- Typed into the composer; Written into the composer by the page or another extension; Dictated by voice -- On the generic fallback adapter the content script installs the paste handler only -- no scan loop, no send gate -- so every non-paste path is unscanned.
How this page stays true
- The coverage declarations hold one explicit value per cell; there is no default and no blank.
- A conformance test drives every cell through the shipped code and fails if the measured result and the declared value disagree, in either direction, with a positive control per cell so a broken harness cannot read as a clean gap.
- Continuous integration fails if the generated page and the declarations disagree, in either direction. This published copy is updated from that generated page.