Keystrokes: a tech blog for builders

I was one query away from publishing that AI assistants fetch this site 80 times for every Google click.

Auto Browse is capped at 20 requests a day, exposed to prompt injection, and running inside your logged-in sessions.

Shortcuts don't lose roadmap fights because they're low value.

No toggle, no policy, no flag, no switch — every route was closed between Chrome 138 and 151.

Open sourcing is a distribution and trust decision with real costs, not an ethical one.

The 'your extensions die on August 31' headlines are a year late: Manifest V2 stopped running in July 2025.

Chrome isn't leaking.

Bind a key to run your own JavaScript on any site.

Bind any key to a click on any button on any website, with no code, using a free Chrome extension that keeps working after the site is redesigned.

How Cloudflare detects bots without a CAPTCHA: TLS and JA4 fingerprinting, HTTP/2 signatures, headless checks, and the 1 to 99 bot score explained.

How Chrome extensions actually execute code: content scripts, isolated versus main worlds, the MV3 service-worker lifecycle, and message passing.

BumbleTap is live.