SubWatch

About

SubWatch is a lightweight integrity sentinel for the modern web. The sites you visit today aren’t simple HTML files; they’re sprawling collections of JavaScript, CSS, images, fonts, iframes, and API calls pulled from dozens of servers. Every one of those sub-resources can change silently, for better or for worse. SubWatch watches them all.

Why you need SubWatch
Dynamic stacks, shifting code
Modern build pipelines redeploy multiple times a day. A benign update might break critical workflows, or an attacker might slip in malicious script (think Magecart / web-skimming).

Sensitive data deserves stability
Banking portals, health dashboards, and internal admin tools shouldn’t mutate unexpectedly. If they do, you want to know immediately.

You set the tolerance
Some pages (news, social feeds) change constantly; others (checkout pages) should stay put. SubWatch lets you decide when a change is acceptable and when it’s a red flag.

How it works
First visit ➜ baseline
The moment you open a domain, SubWatch fingerprints every resource with a SHA-256 hash and stores that baseline locally. It uses content-length or ETAG as well over SHA256 to save on system resources.

Every subsequent visit ➜ compare
As each sub-resource finishes loading, SubWatch re-hashes it in real time. If the hash differs from the baseline, it’s flagged as changed.

Instant visual warning
The extension badge lights up with the exact number of changed resources, no need to click first.

Deep-dive popup
Click the badge to see a color-coded table (green ✓ unchanged, red ✗ changed) plus a quick pie chart overview. Long URLs are neatly ellipsed but still clickable (with safe noopener noreferrer).

You decide
If you’re happy with an update, simply keep browsing. SubWatch will adopt that version as the new baseline next time. Prefer a stricter stance? Treat any red count as a cue to log out or halt transactions.

Key features
- Real-time badge alerts as soon as any resource deviates
- Covers all resource types: scripts, styles, images, iframes, even background-image URLs
- Works across HTTP & HTTPS (ideal for staging / local dev as well)
- Compact visual summary (pie chart) plus full hash details on demand
- Zero external calls: all hashing happens client-side; your browsing stays private
- Minimal permissions: only storage, tabs, webRequest, and webNavigation
- No performance drag: hashing runs after each resource loads, without blocking page render

Perfect for
- Security-minded users who handle banking, crypto, or PII online
- DevOps and QA teams validating that prod assets match the last approved build
- Researchers tracking unauthorized third-party injections over time
- Anyone curious about how often their favorite sites silently swap code

Quick start
1. Install SubWatch and pin it to your toolbar.
2. Browse as usual. If the badge shows 0, every resource matches the last baseline.
3. See a number? Click to inspect changed URLs, decide if you trust them, or step away.

Stay one step ahead of silent site changes and skimming attacks, install SubWatch and surf with eyes wide open.