Weightless AI source code

Why publish it?

Weightless AI promises to send nothing anywhere except the AI engine you choose, to collect nothing and to read nothing unless you ask. A promise can be checked: the code is short, readable, commented, with no third-party library and no minified code.

Security on every level

Before you read the code, here is what we focused on. Each point can be checked in the files shown.

• No server of ours. Your texts go straight to the AI engine you chose, or stay on your computer with Gemini Nano and Ollama. background.js
• A closed list of addresses. The extension’s security policy only allows the AI engines, Google Drive and your own computer: Chrome blocks everything else. manifest.json
• Reading on demand. No permanent script on websites: a page is only read when you ask. background.js
• Keys stay local. Your API keys stay in Chrome’s storage and only go to their provider, never into a log or an export. background.js
• Origin checked. Every message received by the core of the extension is checked: a web page cannot give it orders. background.js
• Filtered answers. Answers are cleaned before display, and only http(s) links are accepted. panel.js
• Plain text in your pages. Rewrite and “Insert” only write text, never code, with an Undo button. background.js
• Booby-trapped pages foiled (new in 3.23). The AI is told that a page’s text is never an instruction, and a suspicious rewrite is not put in automatically: you read it first. panel.js
• No access to your accounts. Actions open pre-filled links: nothing is saved without your click. actions.js
• No code from the Internet. No third-party library, no minified code: nothing is downloaded and then run. manifest.json
• Sandboxed sync. Google Drive is only used in a private folder reserved for the extension, with no access to your other files. background.js
• No trackers. No analytics, no audience measurement, no cookies, in the extension or on this site.
• An audit before every version. The code is reviewed attack scenario by attack scenario, and the issues found are fixed before release.

Download

Each archive contains the code of that version, identical to the package published on the Chrome Web Store, plus a LICENCE.txt file.

• Version 3.23.0

  44 files · 463 KB

  SHA-256 fingerprint of the archive06f8e4b9826290e661db2889c2a57d9301d7410ba3eb85f994f3e55eaea8e2c6

  Download the code

• Version 3.22.0

  44 files · 439 KB

  SHA-256 fingerprint of the archive52dff5aceb99d29e25606976118bdcd45935c35ba229f21083178ba1e218dbdd

  Download the code

• Version 3.21.0

  43 files · 406 KB

  SHA-256 fingerprint of the archive726fcdcfe981c78e3f38c851c9c513698f566c24502e79f08f23bf11b123c012

  Download the code

What you can check

• manifest.json: the permissions requested and the security policy, that is, the closed list of the only addresses the extension can contact.
• background.js: the core of the extension, the calls to the AI engines and the check on where each message comes from.
• panel.js: the assistant window and how answers are displayed, including how they are cleaned before display.
• actions.js: Actions (calendar, tasks, reminders, contacts), which open pre-filled links without ever accessing your accounts.
• privacy-policy.html: the privacy policy, shipped with the extension.

Compare with the installed extension

In Chrome, open chrome://extensions and turn on developer mode: Weightless AI’s ID appears. The installed extension’s files are in your Chrome profile folder, under Extensions/<ID>/<version>. You can also load the unzipped archive with “Load unpacked” to try it as is.

What the licence allows

Allowed: download, read, analyse, load into Chrome for verification, quote short excerpts in an analysis or an audit.

Not allowed without written permission: copying, modifying or redistributing the code, publishing an extension or service derived from it.

© 2026 Laurent Dubourg. All rights reserved, reading permitted.

A question, a vulnerability to report? Write to contact@weightless-ai.fr: every message is read.