Book a demo
Maintain · Changelog

Changelog

What each extension version added, with the console changes released alongside it.

The console and the extension are released together; see Upgrade and reset. Each version lists the changes made since the version before it.

0.7.0

  • Three new rule categories: Payment card numbers (known issuers, Luhn check), IBANs (89 countries, registered lengths, mod-97 check) and National ID numbers (Turkish TCKN with both check digits). The starter rules include them at Let employee choose. See Rule categories.
  • Credentials & secrets also recognizes Google API keys, Slack tokens, Stripe secret and restricted keys, JSON Web Tokens and private key blocks. A private key block is masked as a whole.
  • Confidential terms accept wildcards: * for up to 64 characters other than spaces at the start or end of a word, ? for one character other than a space and # for one digit. Up to 16 of the rule’s 100 terms can use wildcards. The editor explains why a term is rejected. Existing terms that contain *, ? or # now treat them as wildcards (Ticket #4521 needs a digit where # is), and a term left with fewer than two other characters, such as C#, is rejected.
  • Set a built-in category to Off to stop checking for it, for example when card, IBAN or national ID checks misfire on your data. The publish review lists the change as looser. A policy holds one rule per category and keeps at least one on. See Rule categories.
  • Label each app on AI apps as Not reviewed, Approved or Not approved. Administrators set labels in the app’s details; every console user sees them on the rows and can show apps by label. A label never blocks or allows anything.
  • Each app’s details list its sites as URLBlocklist entries for Chrome and Edge, copied on click, under Block in Chrome or Edge. shim still doesn’t block apps itself.
  • A new policy setting, AI app discovery, is on in the starter rules. Browsers whose policy turns it off record no AI apps, the console ignores any they send, and AI apps leaves them out of its counts. The extension settings and the employee notice say that discovery depends on your policy.
  • The review dialog counts the new categories with their own icons, and Requests can be filtered by them.
  • Secondary text meets 4.5:1 contrast in light and dark themes across the console, extension pages, the review dialog and the website. In the light theme, text on the console’s dark sign-in story and policy save bar now uses dark-theme colors, so it no longer fades into the background.
  • Requires migration 003-app-labels.sql; the extension and console must both be on 0.7.0. Policies saved by 0.6.0 have no AI app discovery setting and can’t be read, so reset the database and bootstrap it again, then reset each browser and enroll it again with a new code. See Upgrade and reset.

0.6.0

  • A new AI apps page shows which AI apps your managed browsers opened in the last 30 or 90 days, grouped by whether shim protects them, with how many browsers opened each, on how many days and a daily trend you can compare day by day. Select an app to see when it was first and last seen and, for administrators, which teams and browsers opened it. The overview names the AI apps shim doesn’t check and links to the page. Browsers note 14 AI apps, listed in Coverage and limits, as the app and the day only: never the address, the page or what was typed, and never from incognito windows. Records are deleted after 90 days. Viewers see organization totals only; administrators also see each browser’s apps in its device details.
  • Device details show the AI apps the browser used, before the AI accounts seen, in place of Last AI page check; each opens that app on AI apps. A browser whose composer reports Degraded still shows Needs attention.
  • The extension asks for site access to those AI apps to read the tab’s address; it runs nothing on their pages. Tell employees with the notice in Install the extension.
  • Requires migration 002-app-days.sql; the extension and console must both be on 0.6.0. The new extension cannot read a browser’s stored 0.5.0 enrollment, so reset each browser after the update and enroll it again with a new code.

0.5.0

  • Masks number each distinct value: [REDACTED_1], [REDACTED_2] and so on, and a value that repeats keeps its number, so a masked prompt or file still reads clearly.
  • A flagged file or Claude pasted text now records what shim flagged in it: each distinct value with its page, document part or line, how many times it occurs and the words around it on the same line, for up to 25 values. Administrators see them under Flagged in this file in the request inspector. They are deleted with the file name after 90 days, and the rest of the file is still never captured. The extension and console must both be on 0.5.0.
  • Request filters are part of the page address, so a filtered view survives a reload and can be bookmarked or shared. View all requests in a device’s details opens Requests filtered to that device.
  • Device, request and conversation IDs copy with a single click and confirm in place.
  • Migrations are combined into one schema, 001-platform.sql. A database that applied 009-file-findings.sql already matches it; reset an older one. See Upgrade and reset.

0.4.0

  • Keep several named policies and assign them to teams or to single browsers; the rest use the default. Requests record the policy and version they were checked against, and can be filtered by policy and team.
  • Every published version is kept with its author, an optional note and what changed. Restore loads an older version as a new draft.
  • Changes are reviewed before publishing, with each one marked stricter or looser. Try this policy shows what employees would see for sample text before you publish.
  • Devices groups browsers into teams and uses four statuses: Active, Needs attention, Inactive and Revoked. Select a browser for its details, policy, last AI page check, recent requests and AI accounts, and to move, rename or revoke it.
  • Enrollment codes can enroll a browser straight into a team.
  • The extension shows the name and version of its policy. Requires migration 008-policies-and-teams.sql; the extension and console must both be on 0.4.0.

0.3.0

  • A flagged plain-text file offers Mask and attach, which attaches a copy with every match replaced by [REDACTED]. Under Require masking or Enforce block it is the only way to attach the file. Other file types still can’t be masked.
  • Long text pasted into Claude, which Claude turns into a Pasted text attachment, is checked when it is pasted, with the same choices as a plain-text file. It no longer blocks Send. The text is never captured.
  • Requests record masked files and pasted text with a Masked choice.

0.2.0

  • Files attached, dropped or pasted into ChatGPT, Claude or Gemini are checked on the device before upload: PDF (including Chinese, Japanese and Korean text), Word, Excel, PowerPoint, OpenDocument, RTF and plain-text files. Dynamic XFA forms are kept out. This is an alpha that has not yet been validated on the live sites.
  • Warnings offer Attach once, with an optional explanation, or Don’t attach. Blocked, masked, unreadable, encrypted, unsupported and oversized files are kept out with a reason for each.
  • A new Images in files policy setting blocks image files by default and checks the text of documents with images.
  • Requests show files with their type, size, pages and image coverage; file contents are never captured, and names of flagged files expire after 90 days. Requires migration 007-attachment-names.sql.
  • Requests can be filtered by source: prompt or file.
  • A message can carry files shim checked when they were attached on that page. Any other attachment blocks Send, and the notice names it. Dropping a file closes the site’s drop area; ChatGPT and Claude take checked files through the composer’s file input and Gemini through its message box.
  • Chrome 140 or later is required.

0.1.14

  • Send once explanations appear only in the administrator’s request inspector; the overview no longer carries them.
  • The review dialog says that prompt versions are kept for 90 days and that the choice, explanation and context are also recorded.
  • The policy page describes Require masking as edit or mask before sending; nothing is masked automatically.
  • The explanation character counter meets text contrast.

0.1.13

  • Gemini text prompts on gemini.google.com, with account email and conversation IDs. Requires migration 006-conversation-text.sql.
  • Claude account email and conversation IDs, including chats started from a new chat or a project.
  • Composer status refreshes when the Send control becomes available.
  • The console, extension settings, popup and review dialog use the shim brand.
  • The console highlights detected spans in retained prompts and shows masks as readable [REDACTED] tokens.
  • Requests can be filtered by app, device, detection, result, choice and date.

0.1.12

  • Claude text prompts on claude.ai.
  • The inspector compares the original and applied versions word by word and steps between requests with J and K.

0.1.11

  • Request details record the ChatGPT account email and the conversation ID once a prompt is sent. Requires migration 005-request-context.sql.
  • Edited and masked drafts must pass the current rules before they are sent. Unsafe edits stay in the same panel with an inline warning.
  • The console moves to separate pages for overview, requests, policy and devices, with request search and choice filters.

0.1.10

  • Typing in the review dialog is isolated from page handlers.
  • Every review choice completes through one send path.

0.1.9

  • Original and applied versions are retained separately. Requires migration 004-revised-prompts.sql.
  • Review decisions send immediately and capture the applied version.
  • Request decisions are listed in the order they happened.

0.1.8

  • Applied edited and masked versions are defined with the same 90-day limit as originals.

0.1.7

  • Prompts that match a rule are captured, grouped into requests and opened by administrators in the inspector, with 90-day retention. Requires migration 003-request-prompts.sql.
  • Mask and send submits the masked prompt automatically through the final check.

0.1.6

  • The browser report queue and upload batches are bounded.

0.1.5

  • A recognized empty composer reports Empty draft instead of Unsupported. Requires migration 002-empty-composer.sql.

0.1.4

  • The review offers Edit or mask, Send once and Cancel, with quick masking.
  • Review choices and optional employee explanations are recorded and shown to administrators.

0.1.3

  • A Send once approval is used up by the send it approves.

0.1.2

  • Browser reset asks for confirmation and shows when it is complete.

0.1.1

  • The console and local checks for ChatGPT text prompts.
  • Extension settings open in a tab and report enrollment progress.
  • Blocks the ChatGPT request that can send a draft before Send is pressed.

0.1.0

  • Versioned contracts between the extension and the console.