Politique de confidentialité :

Smart Autofill does not collect, transmit, or store any personal data.

All generated test data is created locally in your browser. Your preferences (selected country, optional seed, selected test card, and the list of sites where the floating button is hidden) are stored using the browser's own extension storage and never leave your device.

The extension makes no network requests of any kind. There is no server, no analytics, and no telemetry.

Notes aux testeurs — le champ le plus important :

This add-on is bundled with Vite, so source code is provided as required.
Build instructions are in README-BUILD.md at the root of the source archive.
Summary: corepack enable && pnpm install --frozen-lockfile && pnpm build:firefox
Verified with Node 24.12 and pnpm 10.33. The build is reproducible; dist-firefox/ matches the uploaded ZIP.

No test account is needed — the add-on works on any form. To try it, open any checkout or registration form, click the floating button (bottom right) or the toolbar popup, then "Remplir la page".

Two points that may look unusual:

1) CARD NUMBERS. The extension writes payment card numbers into forms. These are Stripe's publicly documented TEST card numbers (https://docs.stripe.com/testing), for example 4242 4242 4242 4242. They are only accepted by Stripe test API keys and are rejected in production; they cannot be used to make a real payment. The catalogue is defined in src/core/stripeCards.ts, and a unit test asserts every number passes the Luhn check — except one, 4242 4242 4242 4241, which is Stripe's documented "incorrect_number" test case and must fail it.

2) innerHTML — 5 warnings, from two different origins.

THREE are ours, in src/content/FloatingButton.ts (lines 94, 260, 263), which builds the in-page toolbar inside a shadow root. Only static in-extension constants are interpolated: the card catalogue from src/core/stripeCards.ts, inline SVG icons, and a flag emoji derived from a two-letter ISO country code read from the extension's own preferences and validated with /^[A-Za-z]{2}$/ before use. No page-derived string is ever interpolated; text coming from the page is written with textContent (src/content/toast.ts).

TWO are not ours: they are inside React DOM's own bundle (assets/index.html-*.js), in React's internal setInnerHTML helper for SVG namespaces. Our popup code contains no innerHTML assignment and no dangerouslySetInnerHTML. This can be verified with: grep -rn "innerHTML" src/

The extension makes no network requests whatsoever and collects no data.