SheetSpeedSheetSpeed security
SheetSpeed runs in Chrome. Native shortcuts act through Google's document controls. Connected tools in the 0.4 update call Google APIs directly. Workbook contents are not routed through a SheetSpeed-operated server or an AI provider in the inspected Store packages.
SheetSpeed for Excel on Mac
- Apple-verified: signed with a Developer ID Application certificate and notarized by Apple. Gatekeeper verifies the signature and notarization ticket on first launch.
- One permission: macOS Accessibility (System Settings → Privacy & Security). It is required to observe the Option-key sequences and drive Excel / PowerPoint through accessibility APIs. The app only acts while Excel or PowerPoint is the front app; keystrokes are never logged.
- No network: the app holds no network entitlement — it makes no network connections, ships no analytics or telemetry, and cannot transmit data off the machine (verifiable with
codesign -d --entitlements). - Untrusted user keymaps: bundled keymaps ship inside the signed app. Keymaps placed in
~/Library/Application Support/SheetSpeed/Keymaps/are treated as untrusted:script(AppleScript) steps are dropped at load, so a keymap file can never execute code. - Updates: newer builds are published on this site; every release is signed and notarized the same way.
Implemented controls
- Document-page scope: content scripts match Google document URLs rather than all websites. Core shortcuts do not call a Google API. The public 0.4.0 build also declares identity and Google Sheets, Slides and Drive API hosts for Pro tools. Nothing connects until you approve.
- Request checks: connected commands validate the extension sender and originating document before targeting a workbook or presentation. These are application checks, not a file-level restriction in Google's account-wide Sheets or Slides scopes.
- Packaged code: Manifest V3 uses a content security policy of
script-src 'self'; object-src 'none'for extension pages. The Store packaging removes the native-messaging permission used by the separate development AI helper. - Recovery: connected mutations can keep local undo records and modeling recovery journals. Concurrent edits or an interrupted operation can require reconciliation; those records are not equivalent to a full workbook backup.
- Transport: connected Google requests use HTTPS. There is no additional SheetSpeed encryption layer over Chrome local storage.
Review these boundaries
Core's lack of a Google API token does not mean it lacks document access: its content scripts can read page context and operate document controls. Connected Google permissions are broader than the file selected for a command. Chrome API host permissions are host-level permissions even when endpoint paths are listed in implementation documentation.
Slides refresh in 0.4 temporarily link-shares a PNG in Google Drive and attempts to remove it afterwards. Browser termination or denied cleanup can leave it behind. Organizations that prohibit that sharing should leave the feature unused or block its authorization. See the privacy policy and deployment review.
Report a vulnerability privately
Email jarvis@agi-jarvis.com with “SheetSpeed security report” in the subject. Include the extension version, affected feature, reproduction steps and expected versus observed behavior using a synthetic document. Do not send live access tokens, passwords or confidential document contents.
Security reports go to the product operator. There is no published bug bounty, guaranteed response time or contractual incident-notification deadline. Any organization-specific requirements must be agreed separately. Do not test against other users' data or systems without their authorization.
Stop access and remove local data
- Disable SheetSpeed in Chrome, then reload or close its open Google document tabs to remove already-injected page scripts.
- For a connected build, revoke SheetSpeed at Google account permissions. Settings → Disconnect can clear cached tokens before you disable the extension.
- For routine removal, resolve pending recovery and clear undo history before disabling. If you disabled first to stop access immediately, do not re-enable it just to clear history. Uninstalling removes local extension storage, including recovery records, but cannot undo document edits or erase exported images.
- Inspect Drive for any interrupted temporary image, and clear separately copied files and clipboard contents according to your organization's policy.
Assurance status
No SOC 2 report, ISO 27001 certificate or independent penetration-test report is represented as available. This page describes implementation controls; it is not a certification, compliance guarantee, or statement that an employer has approved SheetSpeed.