Pixel Auditor/Version history

Version history

Every release of Pixel Auditor, newest first — with the major updates in each. Condensed from the project changelog; the finer-grained engineering notes ship with the source.

v2.5.4current version
45+releases since March 2026
171tests passing
14platforms + server-side
v2.5.4 August 1, 2026 Latest Major update

Meta transport capture, Shopify support & the silent-tag audit

The release that closes the "Meta Pixel Helper sees events, other inspectors don't" gap — and turns a tag that's installed but never fires into a first-class finding.

  • Meta form-POST transport capture. Payloads past 2 KB (Advanced Matching, cart contents, CAPI event IDs) go out as a hidden form submission no fetch/XHR/img/beacon hook sees. The form submission itself is now intercepted — so Meta's richest events are captured.
  • Shopify trackShopify support. Shopify's Facebook & Instagram channel routes every Meta event through an undocumented fbq action that was previously dropped. Now fully parsed, including the CAPI dedup event ID.
  • Silent-tag audit. A tag whose library loaded and whose ID was extracted, but which sends nothing, gets a NO EVENTS badge, its own Audit section, and a health deduction.
  • webRequest safety net. Fires from sandboxed and opaque-origin frames — and transports no JS hook covers — are captured observationally, standing down whenever a richer page-sourced capture exists.
  • Early fbq trap. Inline fbq('track','PageView') calls are caught from the moment the page assigns the stub, via a transparent Proxy that never breaks the page's own pixel.
  • Image beacons fully intercepted. createElement('img'), setAttribute('src'), and markup-injected pixels are now covered at the prototype level — previously only new Image() was seen.
  • PII severity calibration. MD5 and base64 digests recognised as hashes, country_code no longer flagged, and pseudonymous IDs (external_id, customer_id) get their own medium tier.
  • Meta event names fixed. Body-carried hits no longer render as tr — rows read PageView / ViewContent / Purchase, and distinct Meta events no longer collapse in dedup.
v2.5.3 July 31, 2026 Correctness patch

Four dead code paths, three state bugs

No new features — nine defects found by auditing the extension against its own intentions, several of them findings that had shipped but never actually counted.

  • Event validation now runs — once per fire, at ingest, in chronological order. The missing-params health deduction, the report's missing: badge, and the CSV column work for the first time, GA4 network hits included.
  • PII now deducts from the health score (raw −10, hashed −5) — previously a page shipping raw emails could still score an A.
  • "Redact PII in exports" toggle (default ON) scrubs JSON, CSV, and HTML deliverables; saved runs no longer retain raw leak values.
  • CSP-blocked tag libraries now scored (−15) — a page whose tag libraries were all refused could previously still score 100.
  • State resurrection fixed — a service-worker cold start could re-insert the previous page's tags over a fresh navigation and persist the corruption.
  • Back/forward no longer blanks the panel — tags repopulate within ~1.5 s after a bfcache restore.
  • Cross-site comparisons flagged — run compare and snapshot diff refuse to silently compare two different sites.
v2.5.2 July 31, 2026 Fix

Google Ads remarketing dedup

One remarketing action fires several beacons (viewthroughconversion, rmkt/collect, 1p-user-list) that derived different pseudo-names and rendered as duplicate rows. Pseudo-names now collapse to one dedup token while real named events keep their own keys.

v2.5.1 July 31, 2026 Fix

CSP library-block detection + PII false positive

CSP refusals of a tag library itself (bat.js, fbevents.js) are now flagged, not just blocked hits; bat.bing.net added as a Bing UET host; and empty placeholder params (external_id=) no longer report a high-severity PII leak.

v2.5.0 July 25, 2026 Major update

Consent ground truth & dedup auditing

  • Per-hit gcd decoding — the consent state each Google hit actually carried, per signal, with default vs. user-update provenance, and a warning when Consent Mode isn't active at all.
  • Meta CAPI dedup audit — when dedup is demonstrably in use, every Meta browser event missing its dedup event ID is flagged: those risk double-counted conversions.
  • Plain-language Page Summary — the paragraph a non-technical client reads first, in the Audit tab and at the top of the HTML report.
  • CSP-blocked fires scored & reported — health deduction, report badge and endpoint table, CSV column.
  • sGTM classifier hardened — Google's closed TLDs (*.goog, *.google) are no longer flagged as server-side proxies.
v2.4.7 – v2.4.9 July 25, 2026 Fixes

CSP-blocked fire detection & classifier fixes

2.4.9 detects tracking requests refused by the site's own Content-Security-Policy — previously shown as delivered when the vendor received nothing. 2.4.8 stops Meta network fires rendering the full request URL as the event name. 2.4.7 stops www.google.com/ccm/collect being flagged as a server-side proxy.

v2.4.1 – v2.4.6 June 28, 2026 Refinements

Google Ads clarity & encoded sGTM transport

  • Encoded sGTM transport decoded — GA4 requests base64-wrapped inside an opaque query param on a first-party path are recovered, with event name and measurement ID (live-tested against a Stape-style custom loader).
  • Conversion Linker handling — Ads setup pings are muted (or hidden with a toggle) so conversion counts read clean, with a fix ensuring only the true Linker is treated as plumbing.
  • Plain-language event summary in the drawer — one consolidated card with identity, value, currency, transaction, and items; packed dynamic-remarketing data= params unpacked.
  • Fully self-contained package — the last remote reference (report fonts) removed for Chrome Web Store compliance.
v2.4.0 June 28, 2026 Major update

New vendors, IAB privacy frameworks, reporting & compare

  • Five new platforms — Segment, Tealium, Hotjar, Criteo, and Klaviyo, each with ID extraction, cookie attribution, filter chips, and pre-consent flagging.
  • IAB privacy frameworks — TCF v2.2, GPP, US Privacy, and Global Privacy Control read from the page's CMP APIs, with an 11-purpose consent grid and a fire audit against denied TCF consent.
  • CSV export of captured fires (RFC-4180) from the Live Events toolbar.
  • Compliance summary at the top of the HTML report — consent pass-rate, pre-consent fires, PII, SST, and a framework table.
  • Cross-run compare — pick any two Saved Runs for a side-by-side delta of stats, tags, and cookies.
v2.3.0 – v2.3.1 May 24 – June 28, 2026 Major update

Unified gtag.js coverage & security hardening

  • Google Ads and Merchant Center via unified gtag.js — ID-driven detection, modern endpoints (/ccm/collect, /pagead/1p-conversion, td/rul), batched-fire fan-out, and Arguments-object dataLayer pushes.
  • Renamed-path sGTM detection — GA4 hits on arbitrary first-party paths (e.g. /kpi/) caught by their Measurement Protocol v2 signature, independent of host and path.
  • Modern GA4 packed item format (pr1=idSKU~nmFoo~…) parsed — ecommerce items render in the drawer.
  • Security hardening — cross-tab state reads locked to the side panel, an authenticated command channel between content scripts, and PII redacted from Saved Runs at the persistence boundary.
v2.0.0 April 22, 2026 Major release

The foundation — first public update since 1.0

The cumulative result of the 1.x development series, shipped to the Chrome Web Store as one release.

  • PII Leak Detector — raw emails, phone numbers, and 15+ named PII fields, with heuristic validation of short-code params.
  • Consent Mode classifier — reads the gcs= parameter and distinguishes denied-state modeling, plumbing, real violations, and inconsistent fires.
  • Consent Mode Simulator — Grant / Deny injection with a 5-second diff, plus one-click Accept / Reject auto-clicks across 19 CMP vendors.
  • Server-Side Tracking detector — script scan, runtime hooks, dataLayer inspection, and network classification against canonical vendor hostnames, with confidence fusion.
  • Saved Runs with side-by-side diff, multi-watch desktop notifications, event search + regex, pause / resume, and a per-fire latency badge.
  • Light + dark themes, a 27-icon SVG system, self-hosted fonts, and an XSS-hardened rendering pipeline.
v1.0.1 – v1.13.1 April 21 – 22, 2026 Development series

The rapid-iteration series

Twenty-seven releases of private development between 1.0 and 2.0 — everything above was built and battle-tested here.

Show the release-by-release list
  • 1.13.0 – 1.13.1 — Server-Side Tracking detector rebuilt (TikTok / Pinterest / Snap / Zaraz / Stape coverage), then a false-positive hotfix with anchored paths and payload verification.
  • 1.12.0 – 1.12.3 — SVG icon registry replacing every emoji, Chrome Web Store compliance audit, Live Events regression hotfix, and the store listing renamed to "Pixel Auditor: Tag, PII & Consent Mode Inspector".
  • 1.11.0 — Watches became per-site scoped with cross-tab firing.
  • 1.10.0 — Six usability fixes from in-use feedback.
  • 1.9.0 – 1.9.2 — Pause/Resume, search + regex, multi-watch, Saved Runs, and the tag latency badge.
  • 1.8.0 — CMP auto-click coverage grew from 12 to 19 vendors.
  • 1.7.0 – 1.7.1 — The tiered Consent Mode classifier replaced the binary pre-consent flag.
  • 1.5.0 – 1.6.0 — The Consent Mode Simulator: Grant/Deny injection, CMP auto-click, storage reset, no-op advisory.
  • 1.4.0 – 1.4.1 — Duplicate-detection overhaul; dark theme became the default.
  • 1.3.0 – 1.3.2 — The PII leak detector shipped, with phone false-positive and stream-regression fixes.
  • 1.1.0 – 1.2.0 — The zinc + violet theme system, light mode, brand-safe platform icons.
  • 1.0.1 — Security & compliance: XSS hardening, bridge message validation, memory caps, self-hosted fonts.
v1.0.0 March 6 – 8, 2026 Initial release

The initial build

  • Core detection engine — 9 tag types across the Google stack (GTM, GA4, Ads, Merchant Center, UA), Meta Pixel, LinkedIn Insight, Bing UET, and Microsoft Clarity.
  • Four capture layers — global-variable scanning, script scanning with MutationObserver, network interception (fetch / XHR / Image / sendBeacon), and JS API hooks (dataLayer.push, gtag, fbq, uetq.push, clarity).
  • Four-tab side panel — Tags, Live Events with detail drawer, Audit with A–F health score and consent timeline, and a searchable dataLayer inspector.
  • Consent Mode tracking, pre-consent flagging, cookie audit, event watches, snapshot/diff, and a self-contained HTML report export.

Running an older version?

Chrome updates extensions automatically, but you can force it: chrome://extensions → Developer mode → Update.

Add to Chrome — Free What's new in 2.5