Guardian

About the project

Guardian is a Google Chrome extension that blocks domains and keywords in URLs. Settings are password-protected, and the Pro plan provides email alerts so parents or guardians can monitor protection status.

Problem

Blocking an address alone does not control who can change the rules or confirm whether protection remains active. For personal use or family supervision, users need to restrict changes and know when protection has been disabled or stopped reporting its status.

Solution

Blocking rules are applied locally by the browser. Configuration changes and access overrides require authentication. Attempts to open blocked addresses are redirected to an extension page.

On the Pro plan, the device periodically sends its protection status to the backend. A missing signal or a reported deactivation can trigger an email to the parent or guardian.

My role

I designed and built the extension, rules engine and alert backend. I also implemented authentication and password recovery, payment integration, interface translations and publication on the Chrome Web Store.

Key features

• Domain and subdomain blocking
• URL keyword filtering with bulk keyword entry
• Password-protected settings
• Backup codes and a recovery phrase
• Authenticated temporary or permanent access overrides
• Support for incognito windows
• Local logs of blocked attempts and a domain allowlist
• Automatic, light and dark themes, with Portuguese and English interfaces
• Pro alerts, weekly email reports, a DNS protection guide and backup

Architecture and technical decisions

The extension uses Manifest V3 and the declarativeNetRequest API. Chrome evaluates dynamic rules and redirects blocked requests to an internal page. This removes the need for scripts that inspect the content of each page to enforce blocking.

The password is stored as a hash derived using PBKDF2 with 150,000 iterations. Recovery codes are single-use and stored as SHA-256 hashes. Settings are kept in chrome.storage.local, and local blocking does not require an account.

Pro features use serverless functions on Vercel, Supabase for device records and SendGrid for email delivery. A scheduled job checks the extension’s signals for deactivation or lost communication. The uninstall URL registered with Chrome is also used to detect removal.

Data is sent only after a parent or guardian registers an email address. It is limited to a random device identifier, protection status, blocked-attempt counts and the most frequently blocked domains. Full URLs and browsing history are not transmitted.

Technical challenges

• Protecting rule changes. Authentication covers settings, domain overrides and protection deactivation within the extension.
• Monitoring protection without collecting full browsing activity. Periodic status signals allow device checks without transmitting browsing history.
• Explaining missing signals. A device can stop reporting because the computer is off. Alerts explain this possibility rather than treating every interruption as a confirmed deactivation.

Outcome

Published on the Chrome Web Store.

Technologies

JavaScript, Chrome Extensions (Manifest V3), Node.js, Supabase, SendGrid and Vercel.