feat: add Firefox support (MV3, Firefox 128+)

- Add manifest.firefox.json with gecko-specific settings and background scripts
- Add scripts/build.sh to generate Chrome and Firefox zip packages
- Zero JS changes needed: Firefox 128+ supports chrome.* namespace and world: MAIN
- Closes #10

PRIVACY.md

@@ -0,0 +1,61 @@
+# Privacy Policy - KeyFinder Chrome Extension
+
+**Last Updated:** April 7, 2026
+
+## Overview
+
+KeyFinder is a browser extension that scans web pages for leaked API keys, tokens, and secrets. This privacy policy explains how the extension handles data.
+
+## Data Collection
+
+KeyFinder does **not** collect, transmit, or share any personal data or browsing data with external servers. The extension operates entirely on your local device.
+
+## What Data is Stored Locally
+
+The extension stores the following data locally on your device using Chrome's built-in storage API (`chrome.storage.local`):
+
+- **Search keywords**: User-configured keywords used to identify potential secrets on web pages.
+- **Scan findings**: When a potential secret is detected, the extension stores the pattern name, severity level, matched value, page URL, and domain where it was found.
+
+This data never leaves your device.
+
+## How Data is Processed
+
+- All page scanning happens locally within your browser.
+- The extension reads page content (scripts, meta tags, form fields, HTML comments, browser storage, and network responses) to match against known secret patterns.
+- No page content, scan results, or browsing activity is sent to any external server, API, or third party.
+
+## Data Sharing
+
+KeyFinder does **not** share any data with third parties. Specifically:
+
+- No data is sold to third parties.
+- No data is used for advertising or marketing purposes.
+- No data is transferred to third parties for reasons unrelated to the extension's core functionality.
+- No analytics, telemetry, or tracking is implemented.
+
+## Data Retention
+
+All stored data remains on your local device until you choose to delete it. You can clear all findings at any time using the "Clear All" button in the findings dashboard. Uninstalling the extension removes all stored data.
+
+## Permissions
+
+- **activeTab**: Used to access the current page's content for scanning when the extension is active.
+- **storage**: Used to save your keyword preferences and scan findings locally.
+- **Host permissions**: The extension runs on all URLs because leaked secrets can appear on any website. No data from these pages is transmitted externally.
+
+## Third-Party Services
+
+KeyFinder does not integrate with, connect to, or send data to any third-party services.
+
+## Changes to This Policy
+
+Any changes to this privacy policy will be reflected in the extension's GitHub repository and the "Last Updated" date above.
+
+## Contact
+
+If you have questions about this privacy policy, contact the developer:
+
+- GitHub: [github.com/momenbasel](https://github.com/momenbasel)
+- X: [@momenbassel](https://x.com/momenbassel)
+- LinkedIn: [linkedin.com/in/momenbasel](https://www.linkedin.com/in/momenbasel/)

README.md

@@ -85,12 +85,6 @@ git clone https://github.com/momenbasel/keyFinder.git
 2. Enable **Developer mode**
 3. Click **Load unpacked** and select the `keyFinder` folder
 
-<img src="https://github.com/momenbasel/keyFinder/blob/master/installGif.gif?raw=true" alt="Installation demo"/>
-
-## Demo
-
-![Demo of KeyFinder](https://github.com/momenbasel/keyFinder/blob/master/demoGif.gif?raw=true)
-
 ## Usage
 
 1. **Install** the extension

manifest.firefox.json

@@ -0,0 +1,44 @@
+{
+  "name": "KeyFinder",
+  "description": "Passively discovers API keys, tokens, and secrets leaked in page scripts, DOM, network responses, and browser storage.",
+  "version": "2.0.0",
+  "manifest_version": 3,
+  "browser_specific_settings": {
+    "gecko": {
+      "id": "keyfinder@momenbasel.com",
+      "strict_min_version": "128.0"
+    }
+  },
+  "action": {
+    "default_icon": {
+      "16": "icons/icon16.png",
+      "48": "icons/icon48.png",
+      "128": "icons/icon128.png"
+    },
+    "default_popup": "popup.html"
+  },
+  "icons": {
+    "16": "icons/icon16.png",
+    "48": "icons/icon48.png",
+    "128": "icons/icon128.png"
+  },
+  "content_scripts": [
+    {
+      "matches": ["<all_urls>"],
+      "js": ["js/patterns.js", "js/content.js"],
+      "run_at": "document_idle",
+      "all_frames": true
+    },
+    {
+      "matches": ["<all_urls>"],
+      "js": ["js/interceptor.js"],
+      "run_at": "document_start",
+      "world": "MAIN",
+      "all_frames": true
+    }
+  ],
+  "background": {
+    "scripts": ["js/background.js"]
+  },
+  "permissions": ["activeTab", "storage"]
+}

scripts/build.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DIST="$ROOT/dist"
+VERSION=$(grep '"version"' "$ROOT/manifest.json" | head -1 | sed 's/.*: *"\([^"]*\)".*/\1/')
+
+rm -rf "$DIST"
+mkdir -p "$DIST"
+
+SHARED_FILES=(
+  js/background.js
+  js/content.js
+  js/interceptor.js
+  js/patterns.js
+  js/popup.js
+  js/results.js
+  css/popup.css
+  css/results.css
+  icons/icon16.png
+  icons/icon48.png
+  icons/icon128.png
+  popup.html
+  results.html
+)
+
+# --- Chrome build ---
+CHROME_DIR="$DIST/chrome"
+mkdir -p "$CHROME_DIR"/{js,css,icons}
+cp "$ROOT/manifest.json" "$CHROME_DIR/manifest.json"
+for f in "${SHARED_FILES[@]}"; do
+  cp "$ROOT/$f" "$CHROME_DIR/$f"
+done
+(cd "$CHROME_DIR" && zip -r "$DIST/keyfinder-v${VERSION}-chrome.zip" . -x '.*')
+echo "Built: dist/keyfinder-v${VERSION}-chrome.zip"
+
+# --- Firefox build ---
+FF_DIR="$DIST/firefox"
+mkdir -p "$FF_DIR"/{js,css,icons}
+cp "$ROOT/manifest.firefox.json" "$FF_DIR/manifest.json"
+for f in "${SHARED_FILES[@]}"; do
+  cp "$ROOT/$f" "$FF_DIR/$f"
+done
+(cd "$FF_DIR" && zip -r "$DIST/keyfinder-v${VERSION}-firefox.zip" . -x '.*')
+echo "Built: dist/keyfinder-v${VERSION}-firefox.zip"
+
+echo "Done. Upload dist/keyfinder-v${VERSION}-firefox.zip to addons.mozilla.org"