RankUp

Enter a FACEIT match lobby and the extension detects the voted map, reads the five enemy players, and plots each of their most-used positions on the radar. Not trajectories — anchors: the spots a player returns to across the most rounds, which is what you can actually prepare against.

For each enemy, recent matches on that map are fetched, the demo download URL is signed, the file is downloaded, Zstandard-decompressed, and parsed with a WebAssembly build of a Rust demo parser. A pool of web workers processes demos in parallel, so a full five-player lobby finishes in a couple of minutes.

Signing the demo URL was the awkward part: the endpoint is Cloudflare-protected, so the request has to go through a page on the site's own origin rather than from the extension directly.

Positions are sampled ten to twenty seconds after each round starts, which skips the walk out of spawn without reaching the part of the round where everyone is reacting to contact. Those samples are clustered, and the top five spots per side are drawn, coloured by roster order.

There is no server, so there is nothing to pay for and nothing to breach. No account, no analytics, no telemetry, and the dashboard makes zero third-party requests — the only origins it touches are the match API and the demo host.

The one sensitive thing it handles is your session cookie, which the demo-signing endpoint requires. It is held in memory for the duration of a scan, sent to one origin, and never stored or logged. Parsed results are cached locally for two weeks; the demo files themselves are never kept.

Version 1.1 adds a paid tier: where each opponent throws smokes and flashes, when, and how often a push follows. Manifest V3 forbids loading code from a server, so the paid features have to ship inside the free extension, switched off. The failure worth guarding against is not someone patching the bundle — that will always be possible in a browser, and stopping it would cost every honest user a server round trip. It is me rendering a paid feature without its gate by accident.

So paid data travels inside a wrapper type with no readable field, and exactly one function can open it. Forgetting the gate is a compile error rather than something a reviewer has to spot. The code says plainly that this is not a security boundary, because it is not one.

Before the store build, the whole codebase went through a written review brief: what is already verified, what to look at hardest, and which odd-looking behaviours are intentional. Every finding had to be fixed or rejected with a reason. The test suite is now past four hundred, there is a test that fails if the manifest asks for a permission the code never uses, and releasing is a script with the safe part as its default. Without a flag it only uploads a draft, which can be replaced. Publishing reaches every installed copy through auto-update and cannot be taken back, so it has to be asked for, and the package step refuses to overwrite a version that already exists — the build that was reviewed is the build that ships.