Check permissions
Before installing or using a browser extension, read what it asks for. Broad permissions need a clear reason and visible behavior.
Protect yourself
Linked with /security/
Protect yourself before you automate.
Remote Tab Opener stays local-first and visible on purpose. This page is the practical checklist for users and developers. The dedicated Security section is the complementary side for website owners who want to publish boundaries with RTO Lock.
Visible tabs
Human approval
No secret goal
No hidden bypass
Daily safety
Use automation only when you can see and explain it.
Keep control
A safe workflow should show what opens, what receives focus, and what action is about to happen.
Stop on surprise
If a workflow clicks, fills, navigates or extracts something you did not expect, stop and review it before continuing.
RTO Security
Protect yourself and protect your website are two sides of the same safety model.
This page: user and developer habits
- Do not share secrets.
- Prefer visible, reviewable workflows.
- Check permissions and allow-list changes.
- Use AI suggestions only after human review.
Website-level boundaries
- Download or generate
rto-lock.json. - Block active automation on sensitive sites.
- Protect login, account, checkout and admin paths.
- Audit the published policy file.
RTO Lock is declarative JSON, not executable code. It gives websites a clear way to refuse Remote Tab Opener active automation before commands run.
Protect your data
Never paste secrets into tools, chats or support forms.
Do not share secrets. Avoid passwords, API tokens, cookies, session identifiers, private keys, internal customer data, confidential URLs, and screenshots containing sensitive content.
Safe details to share
- Browser name and version
- RTO extension version
- Public domain or sanitized URL
- Expected and actual behavior
- Visible error message
Sanitize first
Replace real accounts, tokens, customer names, private paths and business data with placeholders before asking for help.
example.com/account/[redacted]AI-assisted workflows
AI may propose. You decide.
AI can help diagnose selectors, waits, prompts, API payloads and integration mistakes. It should not silently add domains, run a flow, apply a patch, extract secrets or bypass a browser boundary.
Review prompts
Keep private data out of prompts. Send sanitized examples and public test pages whenever possible.
Review patches
A suggested change should be readable before it is applied. If it changes a host, selector or timeout, check why.
Reject surprise
If an AI-generated step would surprise the user or hide the control surface, redesign the workflow.
Safe support
Ask for help with sanitized evidence.
Support is safer when you describe the visible behavior without exposing private data. Include what you clicked, what opened, what message appeared, and what you expected.