popup.html

<!DOCTYPE html>
<html>
  <head>
    <meta charset="UTF-8" />
    <title>Cache Sentry</title>
    <link rel="stylesheet" href="popup.css" />
  </head>
  <body>
    <header>
      <span class="title">Cache Sentry</span>
      <span class="subtitle">Passive cache deception watch</span>
    </header>

    <div id="findings"></div>

    <section id="page">
      <h2 class="section-title">Page loads</h2>
      <div id="documents"></div>
    </section>

    <section id="debug">
      <button id="toggle-skips" type="button" aria-expanded="false" aria-controls="skips">
        Why nothing flagged?
      </button>
      <div id="skips" hidden></div>
    </section>

    <footer>
      <button id="export" type="button" disabled>Export findings (JSON)</button>
      <p class="note">
        Flags requests that send a session cookie and get a cacheable response for
        a URL that looks static but answered with a document. Verify manually
        before reporting &mdash; this is a signal, not proof.
      </p>
      <p class="byline">
        Built by
        <a href="https://github.com/CodeWithSamzy/Cache-sentry" target="_blank" rel="noreferrer">CodeWithSamzy</a>
      </p>
    </footer>

    <script src="popup.js"></script>
  </body>
</html>