# ZeroTrust - AI-Powered Website Security Scanner

A Chrome extension that provides **local-first, privacy-preserving** website security analysis using on-device AI (WebLLM). All processing happens in your browser - no data is sent to external servers.

## Features

- **Trust Score Analysis** - Comprehensive 0-100 security scoring with letter grades (A-F)
- **Security Breakdown** - Detailed analysis of:
  - HTTPS/SSL certificate validation
  - Domain age verification
  - Phishing signal detection
  - Malicious script scanning
  - Cookie compliance checking
  - Form security assessment
- **AI Chatbot** - Ask questions about any website's security and content
- **Real-time Scanning** - Instant security assessment of any webpage
- **100% Local** - All AI processing runs in your browser using WebGPU

## AI Models

Choose from three models based on your device capabilities:

| Model | Size | VRAM | Best For |
|-------|------|------|----------|
| Gemma 2 2B | ~1.5GB | 2GB | Quick scans |
| **Phi-3 Mini** ⭐ | ~2GB | 3GB | Recommended |
| Llama 3.1 8B | ~4.5GB | 6GB | Complex analysis |

## Installation

### From Source

1. Clone the repository:
   ```bash
   git clone https://github.com/yourusername/zerotrust.git
   cd zerotrust
   ```

2. Install dependencies:
   ```bash
   npm install
   ```

3. Build the extension:
   ```bash
   npm run build
   ```

4. Load in Chrome:
   - Open `chrome://extensions/`
   - Enable "Developer mode"
   - Click "Load unpacked"
   - Select the `dist` folder

## Development

```bash
# Development mode with hot reload
npm run dev

# Build for production
npm run build

# Lint code
npm run lint
```

## Architecture

This is a **Manifest V3** Chrome extension with multiple components:

```
┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   Popup     │────▶│  Background │────▶│  Offscreen  │
│   (React)   │     │  (Router)   │     │  (WebLLM)   │
└─────────────┘     └─────────────┘     └─────────────┘
                           │
                           ▼
                    ┌─────────────┐
                    │   Content   │
                    │  (Scanner)  │
                    └─────────────┘
```

- **Popup** (`src/popup/`) - React UI for interaction
- **Background** (`src/background/`) - Message routing, offscreen management
- **Offscreen** (`src/offscreen/`) - WebLLM engine, AI inference
- **Content** (`src/content/`) - Page analysis, trust score calculation

## Tech Stack

- **React 19** - UI framework
- **TypeScript** - Type safety
- **Vite** - Build tool
- **Tailwind CSS 4** - Styling
- **WebLLM** - On-device LLM inference
- **WebGPU** - GPU acceleration

## Security Scoring

The trust score (0-100) is calculated from:

| Factor | Max Points |
|--------|------------|
| HTTPS Connection | 15 |
| Valid Certificate | 10 |
| Domain Age | 10 |
| No Phishing Signals | 25 |
| No Malicious Scripts | 20 |
| Cookie Compliance | 10 |
| Form Security | 10 |

### Grade Scale

- **A** (90-100): Excellent security
- **B** (80-89): Good security
- **C** (70-79): Moderate concerns
- **D** (60-69): Poor security
- **F** (0-59): Critical issues

## Privacy

ZeroTrust is designed with privacy as a core principle:

- All AI processing happens locally in your browser
- No website data is sent to external servers
- No analytics or tracking
- No account required

## Requirements

- Chrome 113+ (WebGPU support)
- Minimum 4GB RAM (8GB recommended)
- GPU with WebGPU support

## License

MIT License - See [LICENSE](LICENSE) for details.

## Contributing

Contributions are welcome! Please read our contributing guidelines before submitting PRs.

---

**Never Trust, Always Verify.**