This is what happens when you vibe-code a product that handles sensitive user data: I saw this extension announcement going viral and thought it looked cool, so I checked it out. My first concern was whether my emails would be sent to someone I don't know. I was relieved to see you could bring your own Anthropic API key. The website states your API key and email text go straight to Anthropic and "never touch our servers." Then, when you try it, you hit a paywall where you can input your key. Same claim: your key is stored locally and calls go directly to Anthropic. I got curious and decided to check the Chrome extension source code. Damn. Not only does it send your email text to their servers, it also sends your API key! So both claims, that it calls Anthropic directly and that your API key is stored only locally, are completely false. I'm giving the creator the benefit of the doubt and assuming this was negligence, not malice. He used his real name on Stripe and in the Chrome Web Store. But the lesson is bigger than one project: building with AI is fun, but if you're handling people's data, making security claims, and charging money, you need real review before shipping.