glm-usage-monitor

Security Policy

This document describes the security model of GLM Usage Monitor — how it works, an honest threat model, and the one way it differs from the extension it was modeled on (msadofschi/claudetrack).

The extension is open source and unminified. Every claim below is checkable against the source in this repository, primarily manifest.json, background.js, popup.js, and options.js.

How it authenticates (and why it needs a key)

claudetrack reads claude.ai usage by riding your session cookie (credentials: 'include') — no key needed, because the page is cookie-authed.

GLM Coding Plan usage is not cookie-authed. The Z.AI monitor API (api.z.ai/api/monitor/usage/*) requires an Authorization: <token> header (the same Coding Plan key you use with Claude Code). So this extension asks you to paste that key once in Settings, and stores it locally. That is the unavoidable difference, and the rest of this model is about bounding its blast radius.

Permissions

Declared in manifest.json:

Permission	Why	What it does not grant
storage	Persist the key + usage data + prefs locally	No network, no page access, no sync
alarms	Schedule the periodic refresh	Nothing else
host: api.z.ai/api/monitor/usage/{quota/limit,model-usage,tool-usage}	Read Z.AI usage	Read-only; no other path on api.z.ai
host: open.bigmodel.cn/api/monitor/usage/{quota/limit,model-usage,tool-usage}	Same, for the China platform	Read-only

There is no cookies, tabs, scripting, webRequest, <all_urls>, or any broad host permission. There are no content scripts, no web_accessible_resources, and no externally_connectable.

What the extension can and cannot access

Can read (with your key)	Cannot access
5-hour / weekly token usage %, totals, reset times	Your chats, code, or files
Monthly MCP usage % + per-tool counts	Billing or payment methods
24-hour model/tool usage counts	Any non-monitor endpoint or other domain
Your plan tier label (e.g. Pro)	The value of any other credential

• Every request is a GET to one of the six monitor paths above (background.js). It cannot send messages, spend quota, or mutate your account.
• The key and all data live only in chrome.storage.local on your device.
• API responses are rendered with .textContent, never innerHTML (popup.js, options.js), so a malformed or hostile response cannot inject markup.
• The message listener in background.js only accepts REFRESH, SET_INTERVAL, and TEST_CONNECTION from this extension’s own pages. With no externally_connectable, no web page can message the extension.

Threat model

The stored key is the one real asset

Unlike claudetrack (which holds no credential), this extension stores your Coding Plan key. Realistically that key already grants more than this extension ever does — it can make model calls and spend your plan — so the extension does not increase the key’s reach. But a key stored on disk is a key worth protecting:

• It is kept in chrome.storage.local (the extension’s local DB), not sync. It does not leave your device except in the Authorization header to the monitor endpoints above.
• The China-platform host permission is only reachable if you select that platform in Settings; if you only use Global, you can delete the three open.bigmodel.cn entries from host_permissions before installing.

Supply chain / compromised release

This is the realistic, generic risk for any auto-updating extension. A compromised build is bounded by what the manifest already grants:

• With the current permissions, the most a malicious build could do is read your usage metadata + plan tier and exfiltrate your stored key to an attacker server (a fire-and-forget request needs no readable response). That is the blast radius: usage numbers, a plan name, and the key you pasted.
• To reach anything beyond the monitor paths or other domains, a malicious version must widen host_permissions — which is not silent: the browser surfaces a new-permission prompt and disables the extension until you re-approve it, the change is visible in a public diff, and it is subject to store review.

No dependency supply chain

The extension has zero third-party runtime dependencies: no package.json, no bundler, no build step. The JavaScript in this repository is exactly what runs. There is no npm layer for a malicious package to ride in through.

Out of scope

• Vulnerabilities in Z.AI / ZHIPU’s own APIs — report those to the provider.
• Attacks requiring a pre-compromised machine or a malicious browser build.
• Social engineering of the maintainer.

Data handling and privacy

• All data is stored locally in chrome.storage.local. Nothing is synced to a server, sent to the maintainer, or shared with third parties.
• No analytics, no telemetry, no crash reporting, no ad networks.
• The only network destinations are the six monitor URLs in manifest.json.

Reporting a vulnerability

Open a private issue or contact the maintainer via the repository. Do not open a public issue for security problems.

This site is open source. Improve this page.