The security model in one paragraph
Fullport Tap is a panel, not a wallet. Your evaluation balance is a number on Fullport's engine; when you press Buy, the extension sends an order to that engine and the engine prices it from a fresh read of the token's curve or pool. Nothing is signed, nothing is broadcast, and nothing on the terminal page is clicked on your behalf. The terminal provides the chart; the extension provides a second, simulated account beside it.
That is why the permission list is short and why the word wallet does not appear in the manifest at all. An extension that cannot reach your keys cannot lose them.
Every permission, in plain words
| Permission | What it is for | What it cannot do |
|---|---|---|
| storage | Keeps your Fullport session and panel settings in extension storage. | Cannot read other extensions' storage or your browser's site data. |
| alarms | Wakes the service worker to sync resting orders and fills and to refresh the kill-switch config. | No network access of its own; it only schedules work. |
| notifications | A toast when a fill completes or a take-profit / stop-loss fires while you are on another tab. | Cannot read notification content from other apps. |
| host permissions (18 terminal domains) | Inject the panel on coin pages and read the token address from the URL. | Does not run on wallet sites, exchanges, email, banking or anything not in the list. |
Swipe or scroll to compare all columns.
Sites the extension may run on: axiom.trade, gmgn.ai, padre.gg, fomo.family, pump.fun, bullx.io, tinyastro.io, dexscreener.com, jup.ag, birdeye.so, lute.gg, trojan.com, shotgun.fun, telemetry.io, cielo.finance, azura.xyz, solpump.io, definitive.fi. Remote code: none. All code ships inside the package; the only JSON exchanged leaves for fullportcapital.co and fullport-engine.fly.dev.
What it reads, and what it never touches
- Reads: the current page URL (to find the token or pool address), the Fullport session you created with one explicit click on /connect, and the panel settings you chose.
- Never touches: wallet extensions, seed phrases, private keys, the clipboard, form fields on the terminal, your transaction history, other tabs.
- Never does: click, submit or modify anything on the terminal page. The panel lives in a closed shadow DOM beside the page, not inside it.
By design, Tap only arms on a page whose URL carries a token or pool address. On feed pages (Axiom Pulse, the GMGN home page) it stays in HUD mode rather than guessing from page markup — guessing is how an overlay ends up trading the wrong coin.
Verify the build you installed
- 1
Install only from the Chrome Web Store
There is exactly one listing — Fullport Tap on the Chrome Web Store — and every install button on this site points at it. Install only from this official listing. Downloads from other websites and manually distributed zip files are not supported.
- 2
Check the publisher and the id
The listing is published by Fullport Capital and its extension id is kcjcpoadokehcmhippbncfpaaibkfcep. Chrome shows the id on chrome://extensions; if it differs, it is not this extension.
- 3
Read the permissions Chrome shows you
At install Chrome lists exactly what the extension asked for. It should match the three permissions above and the terminal hosts — and say nothing about wallets.
- 4
Connect with one click, on purpose
The extension only gets a session when you press Connect on fullportcapital.co/connect while signed in. It is a separate session you can revoke from your account settings at any time.
Report a vulnerability
Write to fullportcapitalco@gmail.com with "security" in the subject, or use the contact in /.well-known/security.txt. We acknowledge within two business days.
Quick answers
- Is Fullport Tap safe to install?
- It requests no wallet permission and has no way to sign a transaction: there is no wallet adapter, no key handling and no injected provider in the code. The only network calls go to fullportcapital.co and the Fullport engine. It installs from the Chrome Web Store, so the build you run is the one Google reviewed and signed, and your browser verifies that signature on every update.
- Can a Chrome extension steal from my Solana wallet?
- A malicious one can — by injecting into wallet pages, reading clipboard contents, or swapping addresses in the DOM. Tap does none of those things: it only runs on the terminal domains listed below, reads the token address from the URL, and draws its own panel in a shadow DOM that cannot see or alter the terminal's controls.
- Why does it need access to 18 sites?
- Because the panel has to appear on the coin page of each supported terminal. Host permissions are generated from the same table that lists the terminals on this site — nothing else is in the list, and the extension never loads remote code.
- What data does it store?
- Your Fullport session token and panel preferences (presets, slippage, unit), locally in extension storage. No browsing history, no wallet addresses, no clipboard.