Settings and security dashboard

The extension popup includes a settings and security dashboard for the browser device itself. It lets you configure local behaviour, see which devices are enrolled on your account, and review recent activity — all without standing up anything new on the server.

Where settings live

Extension preferences persist in chrome.storage.local, scoped to the browser profile. These are local-behaviour settings (auto-lock interval, site-access choices, and similar), not vault data — no secret material is stored here. Because the settings are local to the profile, clearing the browser’s extension storage resets them without affecting your account.

Managing enrolled devices

The dashboard lists the devices enrolled on your account and lets you act on them:

• Review enrolled devices. Each browser or client that has registered shows up as its own device.
• Revoke a device. Removing a device invalidates its session, so a lost or retired browser can no longer refresh its way back into the vault.

These actions use the existing device endpoints — the dashboard is a view over them, not a new control plane. See Install and unlock for how a device gets enrolled in the first place.

Reviewing recent activity

The dashboard surfaces recent audit activity so you can see what has happened on the account from inside the extension. This reads the same tamper-evident trail described in Audit logs; the extension does not keep its own separate log. If something looks wrong, this is where you would notice an unexpected access or device.

Auto-lock

Auto-lock is driven by chrome.idle. You set an idle threshold; when the browser reports the user has gone idle for that long, the extension drops its in-memory token and marks the session locked, so the next use requires the device-bound unlock again.

• Auto-lock requires the idle permission, which the extension declares for this purpose.
• Locking clears the cached session in memory; it does not delete the enrolled device or the refresh token, so unlocking again is just the biometric prompt rather than a fresh enrolment.

Nothing here changes server state

The settings and security dashboard is intentionally read-and-local: it persists preferences in chrome.storage.local and otherwise only calls the existing device and audit endpoints. There is no extension-specific server state — managing devices and reviewing activity go through the same APIs the rest of VaultTerm uses.

Where to go next

• Install and unlock — enrolment and the device-bound unlock.
• Browser extension overview — features and the permissions model.
• Audit logs — the full trail the dashboard reads from.