Security

Parla works with your microphone, so it is built to be hard to abuse. Your voice never leaves your device, the extension asks for as little as it can, and every piece of code we ship is pinned, scanned and tested before it reaches you.

While you use Parla

• Your voice is cleaned on your device, inside the browser. Parla has no server that receives audio, and no accounts or passwords that could be stolen.
• The engine is our own code, written in Rust without third-party libraries, and runs as WebAssembly in the browser's sandbox. The AI models are data (numbers), not programs: no code from the models' authors runs on your computer.
• The extension asks only for what cleaning a microphone needs: to keep its settings and to run in the pages where you use your microphone. Its own pages run only their own scripts (a strict Content Security Policy).
• Web pages reach the extension only through a narrow channel: they get the engine's files and nothing else, and everything they send is checked and limited in size.
• Reports are off until you turn them on. They are anonymous, and every field is listed in our documentation.

From our code to your browser

• Everything the build uses is pinned to an exact version and checked by its fingerprint: GitHub actions by commit, container images by digest, downloads by SHA-256, npm and Python packages by lockfile.
• No release younger than 3 days goes in. Most malicious package versions are found and removed within days, so we let them be caught first. Automatic updates wait a week, and each one is built and tested before it is accepted.
• Packages are never allowed to run install scripts, and the npm registry's signatures are verified on every build.
• Only our automated pipeline builds releases, from the main branch. The store and npm credentials are kept in a protected environment that only the release step can use, and the build does not keep the repository's access token.

Checked on every change

• Static analysis: CodeQL reads the TypeScript, the Rust engine and the build workflows; zizmor audits the workflows.
• A dynamic scan of the website (OWASP ZAP) on every change and every week.
• A change that adds a package with a known vulnerability is blocked, and Dependabot alerts watch every lockfile.
• Secret scanning with push protection: GitHub refuses any commit that contains a password or key.
• Strictly typed code (TypeScript and Python) and automated tests in Chrome and Firefox before every release.

Found a problem?

Please tell us privately: report a vulnerability on GitHub. That way it can be fixed before it is made public.

Everything on this page can be checked: the code, the build pipeline and the security checks are open source. How releases are built and checked