Security

There is no database, no user account and no server-side copy of your transaction. The web application is a set of static files. Your figures are computed in your browser and stay there.

This is a design decision with teeth: a product with no customer database cannot leak one. It also means we cannot recover your data for you — closing the tab really does lose it.

Browser extensions declare, in advance, which sites they may run on. Maytrika declares these:

• www.incometax.gov.ineportal.incometax.gov.in
• www.tdscpc.gov.incontents.tdscpc.gov.in

It does not ask for access to all sites. It does not request the cookies permission, so it cannot read your government session cookie. It does not request webRequest, so it cannot watch your network traffic.

Host matching is exact. A site called incometax.gov.in.example.com does not match www.incometax.gov.in, and the extension will say so rather than filling anything in.

Any input of type password is skipped unconditionally. So is any field whose id, name, label, placeholder or autocomplete hint mentions a password, an OTP, a PIN, a CVV, a CAPTCHA, a card or account number, a session, a token, or e-verification.

The check runs before the field is scored for relevance, so a credential field cannot be filled even if it happens to look exactly like the field we wanted.

The extension will not, and cannot:

• log in to the portal,
• solve or bypass a CAPTCHA,
• read or enter an OTP,
• submit the form,
• authorise a payment or enter banking details,
• complete e-verification.

There is no “submit automatically” button, and no hidden code path that clicks one. The interface it drives is the same visible interface you see; it does not reach into the portal’s internal state or call its private endpoints.

Everything the extension runs ships inside the extension package and is reviewed before release. It uses no eval(), no new Function(), and it never fetches and executes JavaScript. A strict Content Security Policy enforces this even if someone later makes a mistake.

Government portals change. Rather than guess which box is which, every candidate field is scored, and a field is only filled when the match is unambiguous — currently 80% confidence or better. Below that, you are told which field could not be identified and you fill it yourself.

If the page cannot be recognised at all, nothing is entered and the extension says so. A form half-filled with plausible-looking wrong values is far more dangerous than a form left alone.

Current status: field mappings for the live portal have not yet been verified against the real form, so autofill is deliberately disabled on the production portal. It runs against the local demo form only. Guessed selectors will not be shipped.

Dependencies are pinned to exact versions with a committed lockfile, kept few in number, and audited on every install. The Chrome Web Store account used for publishing has multi-factor authentication enabled.

If your computer is already compromised, nothing here helps: malware on your machine can read your screen and your keystrokes regardless of how this tool is built. The same is true if you install a malicious browser extension alongside this one.

And the arithmetic being right is not the same as the tax treatment being right. Have a chartered accountant check anything unusual before you file.