Security & data
How WebAct scopes page access, protects account sessions, and handles website examples and connected task results.
Last updated: September 21, 2026
You choose where WebAct works
Activate the extension on the tab you want to use. It does not request blanket access to every website. Select a region or visible-page context for the task, and review the scope of sensitive actions.
Browser restrictions can prevent access to some pages. Approving arbitrary page code can grant broader effects than a predefined action; inspect the source and intended scope before approving it.
Website examples and extension tasks
The website’s examples use synthetic data. The contact composer runs locally and does not submit its input. Actual automation tasks run in the extension, where selected page context is shared with your AI provider. Review the context before starting a task.
Extension AI assistance has a different path: chosen context and instructions are processed by the selected connection, and automation state may persist in the service.
Protected sign-in
The account implementation hashes passwords with a salted password-hashing function, stores session-token hashes server-side, and uses a Secure, HttpOnly, SameSite=Lax session cookie in production.
Verification and password-reset challenges are single-use, expire, and have request or attempt limits. Credential resets revoke older sessions. Correct production HTTPS and service configuration remain necessary for these controls.
Controlled webhook delivery
Connected destination addresses and signing secrets are encrypted in service storage. Destinations are validated as public HTTPS endpoints; private-network targets and redirects are rejected.
Optional signing and stable delivery identifiers support verification and deduplication at the receiver. These controls do not guarantee the behavior of a downstream workflow. Check uncertain deliveries before retrying.
Report a concern
Use Contact & support to prepare a security report. Include the affected feature, steps to reproduce, and impact using test data where possible. Never send passwords, session tokens, signing secrets, or unnecessary personal content.
This overview describes implemented controls; it is not a certification, audit report, or guarantee that every deployment has been configured correctly. The privacy policy describes data handling in more detail.