[Show] OPSECHub: An open-source, zero-telemetry browser suite to mitigate active profiling and traffic analysis.

Hey r/opsec,

I lead an offensive cyber research team and frequently interact with untrusted environments. I needed a way to conduct investigations without relying on heavy extensions that secretly log telemetry. So, I built OPSECHub—a completely local, Manifest V3 browser suite.

My Threat Model:

• Adversaries: Active profiling mechanisms (servers fingerprinting my environment) and passive local eavesdroppers (ISPs/network monitors logging my targets).
• Goal: Conduct web investigations without leaving unique traces, leaking my real IP, or allowing adversaries to map my timeline or identify my infrastructure.

How OPSECHub mitigates these specific threats:

• Defeating Profiling: Introduces persistent noise to Canvas/WebGL rendering and spoofs hardware strings (CPU cores, RAM) to prevent target servers from fingerprinting the specific research machine.
• Preventing IP Leaks: Enforces strict WebRTC routing policies to stop STUN/TURN leaks, and includes a built-in Proxy Manager (HTTP/SOCKS5) for safe, instant routing.
• Obfuscating Traffic Analysis: A background "Decoy Traffic Generator" creates automated network noise to mask real investigative patterns from local network monitors.
• Network Shielding: Uses a DeclarativeNetRequest core (powered by HaGeZi rules) and live threat feeds (PhishTank, URLHaus) to block dynamic DNS abuse and badware hosters at the network level.

Supporting OPSEC Utility Belt: To avoid switching between different external tools during an investigation, I integrated several local utilities directly into the extension:

• Data Sanitization: Strips tracking parameters (utm_*) from URLs and completely removes EXIF metadata/tracking pixels from downloaded PDFs and Office documents.
• Infrastructure Analysis: Built-in CSP & HTTP Security Headers Analyzer, SSL Certificate Inspector, and a DNS-over-HTTPS (DoH) Leak Checker.

(Note: There are many more capabilities built into the suite that I haven't detailed here to keep this post readable, such as a Short Link Redirect Tracer, local Document Encryptor, Hash Calculator, and Cookie/Storage Guards. You can check out the full feature list and screenshots on the GitHub page).

Everything executes strictly locally. Zero analytics, zero data exfiltration.

I have read the rules

GitHub (Source & Setup):https://github.com/tomsec8/OPSECHub/tree/mainChrome Web

Store:https://chromewebstore.google.com/detail/gkhbmoafodmekcdpkcgpekfkhffjbijl

I’d appreciate any feedback on the architecture or suggestions for other OPSEC vectors that could be mitigated at the browser level.