I shipped a Chrome extension, then found a permission bug and a hidden analytics call in the same week

The problem I was scratching Every time I was debugging a web app, the same friction kept happening: I'd see a request in Chrome DevTools' Network tab, and to actually test a variation of it — a different header, a different body, a different query param — I had to copy it out to Postman or Insomnia, paste it in, re-add auth headers, and lose all the DevTools context in the process. Small friction, but it happened a dozen times a day. So I built Network Sniper , a Chrome extension that puts an editable, resend-capable request panel directly inside DevTools. Capture a request, edit it in place, hit resend, and see a diff between the old and new response — no context switch. It's local-first by design: no telemetry, no cloud sync, sensitive headers masked by default. That promise turned out to be more important than I expected, for reasons I'll get to. Launch day: smaller than I hoped, which taught me something I posted a Show HN. It didn't hit the front page — under 10 upvotes, a handful of comments. In the first few hours I got about 15 installs, then growth flattened out almost completely. If you're benchmarking your own launch: don't assume a Show HN that doesn't take off means the product is bad. It might just mean the post didn't catch the algorithm's attention that hour. I posted on a Wednesday; in hindsight I'd try a different day and spend more time on the title. The bigger lesson came from what happened after launch, not the launch numbers themselves. Surprise #1: I accidentally asked for way too much permission To support resending requests to any API the user is debugging (which by definition could be any origin — that's the whole point of the tool), my first shipped version declared: "host_permissions" : [ "*://*/*" ] This works, technically. It also means Chrome shows every installer a scary warning: "Read and change all your data on all websites." For a tool whose entire pitch is "trustworthy, local-first, minimal," that's a bad first impression — and i