DEV Community: Tridib Banik

I built a Chrome extension that grades stocks with deterministic rules; here's the privacy architecture

Tridib Banik — Wed, 26 Aug 2026 05:14:44 +0000

Most stock tools want your broker login, your portfolio data, or give you opaque AI picks you can't verify. I built StockAgent, a Chrome extension that grades your watchlist using transparent, deterministic rules, and I wanted to share how I designed the privacy layer because I think the pattern is useful beyond finance apps.

What StockAgent does (quick context)

Each stock scores 0–5 on five financial metrics:

Factor	+1 if
Debt-to-Equity	Below sector threshold
PEG	Below threshold (varies by sector)
ROE	Above 15% (or 8–12% for banks/utilities)
200-day SMA	Price above moving average
RSI	Below 35 (oversold)

On top of this, news headlines from Yahoo Finance RSS are scanned for risk keywords and scored by severity:

Severity	Penalty	Examples
Severe	-2 per headline (cap -3)	Fraud, bankruptcy, SEC, delisting
Moderate	-1 per headline (cap -2)	Lawsuit, downgrade, layoffs, earnings miss
Mild	0 (informational only)	Guidance cut, analyst concern

Final score: 4–5 = STRONG BUY, 3 = HOLD, 0–2 = AVOID. Same data = same grade, every time. No AI in the scoring loop.

The extension also sends scheduled email digests and optionally uses a BYOK Gemini key to explain grades in plain English (never influences the score).

The privacy problem

Users track stocks with real money. They want grades, but they don't want their share counts or buy prices on someone else's server. So the challenge was: how do you build a useful cloud feature (email reports) without ever seeing the user's actual portfolio?

The solution: three-layer privacy enforcement

Layer 1: Two-tier storage

Everything lives in chrome.storage.local, but the code treats it as two separate tiers:

// PRIVATE (never transmitted)
holdings: { NVDA: { shares: 50, buyPrice: 120.00 } }
geminiApiKey: "sk-..."
autoAnalyze: true

// CLOUD-ELIGIBLE (sent only if user opts into email)
watchlist: ["NVDA", "AAPL", "SHOP.TO"]
delivery: { email: "...", schedule: {...}, enabled: true }

Layer 2: Allowlist payload construction

When the user clicks "Save & Subscribe," I don't copy the local state and strip private fields. That's fragile. One missed field, and you leak data. Instead, the outbound object is reconstructed from scratch using only allowed fields:

export function buildCloudPayload(state) {
  const email = String(state?.delivery?.email ?? "").trim().toLowerCase();
  const schedule = normalizeSchedule(state?.delivery?.schedule);
  const watchlist = (Array.isArray(state?.watchlist) ? state.watchlist : [])
    .map(normalizeTicker)
    .filter(Boolean)
    .slice(0, MAX_WATCHLIST);

  return { email, watchlist, schedule, enabled, userId };
}

Holdings and API keys are never referenced here. They can't leak because they're never included.

Layer 3: Runtime blocklist assertion

Even after allowlist construction, every payload passes through assertNoPrivateLeak() before hitting the network:

const FORBIDDEN_CLOUD_KEYS = Object.freeze([
  "holdings", "shares", "buyPrice", "avgBuyPrice",
  "geminiApiKey", "geminiKey", "apiKey",
  "autoAnalyze", "netWorth", "portfolio",
]);

export function assertNoPrivateLeak(payload) {
  const stack = [payload];
  while (stack.length) {
    const node = stack.pop();
    for (const [key, value] of Object.entries(node)) {
      if (FORBIDDEN_CLOUD_KEYS.includes(key)) {
        throw new Error(`Refusing to transmit private field: ${key}`);
      }
      if (isPlainObject(value)) stack.push(value);
    }
  }

  // Root-level allowlist — reject ANY unexpected field
  const allowed = new Set(["email", "watchlist", "schedule", "enabled", "userId"]);
  for (const key of Object.keys(payload)) {
    if (!allowed.has(key)) {
      throw new Error(`Refusing unexpected cloud field: ${key}`);
    }
  }
  return payload;
}

This catches:

A developer accidentally adding a field to the payload
A merge conflict introducing a private key
Any nested object containing forbidden fields

Layer 4 (bonus): Server rejects it anyway

The FastAPI backend uses Pydantic with extra="forbid" on every schema:

class SubscribeRequest(BaseModel):
    model_config = ConfigDict(extra="forbid")

    email: EmailStr
    watchlist: list[str]
    schedule: ScheduleConfig
    enabled: bool = True

If a payload with holdings or geminiApiKey somehow arrived, the API returns 422 before touching the database. Belt and suspenders.

The call path

User clicks "Save & Subscribe"
  → buildCloudPayload() reconstructs from allowlist
  → assertNoPrivateLeak() walks the object, throws on forbidden keys
  → POST /api/subscribe { email, watchlist, schedule, enabled }
  → Pydantic rejects extra fields (422 if violated)
  → Supabase stores ONLY email, tickers, schedule, timezone

Why this pattern matters beyond finance

If you're building any Chrome extension that handles sensitive data — passwords, health info, personal notes — this three-layer approach works:

Construct outbound payloads from scratch (don't filter existing state)
Assert at runtime before every network call (catches future regressions)
Reject unknown fields server-side (defense in depth)

It's more work upfront than just "don't include the field," but it turns a convention into an invariant. A future contributor can't accidentally break it without seeing a hard error in development.

The rest of StockAgent

The privacy architecture is one piece. The extension also has:

Deterministic grading engine: 5 financial metrics with sector-aware thresholds (banks, tech, pharma, crypto all scored differently)
Tiered news risk scoring: Yahoo RSS headlines penalize stocks by severity (fraud = -2, lawsuit = -1, guidance cut = informational)
Scheduled email digests: AWS EventBridge + Lambda fires every 5 min for punctual delivery
Optional AI explanations: BYOK Gemini key explains grades in English — never influences the score
Multi-region: US, Canada, and India exchanges

I Auto-Save Every Accepted HackerRank Solution to GitHub — Here's How

Tridib Banik — Fri, 10 Jul 2026 04:33:04 +0000

I practice on HackerRank a lot. The problems are fine, but I kept losing my own work.

I'd solve something, move on, and weeks later I couldn't remember:

What trick I used
The time/space complexity of my solution
Where I even saved the code

Copy-pasting into random files didn't scale. I wanted a GitHub repo that looked like interview prep, not a junk drawer.

So I built PrepPush — a Chrome extension that watches for Accepted submissions and pushes them to your GitHub repo automatically.

The workflow I wanted

Solve a problem on HackerRank
Click Submit Code until it's Accepted
Code lands on GitHub — organized, labeled, ready to revise before interviews

No manual copy-paste. No forgetting which approach was approach1 vs approach2.

What shows up on GitHub

Each accepted solution goes here:

solutions/{language}/{difficulty}/{problem-slug}/solution-approach1.py

If you solve the same problem with a different algorithm, you get solution-approach2.py, and so on.

Re-submitting the same logic updates the same file — no duplicate spam.

Example header PrepPush adds to the file:

# Link        https://www.hackerrank.com/challenges/alternating-characters/problem?isFullScreen=true
# Problem     Alternating Characters 
# Difficulty  Easy
# Subdomain   Strings
# Language    python3
# Submitted   2026-07-25, 10:46 a.m.
# Technique   linear-scan-adjacent-comparison
# Time        O(n)
# Space       O(1)
# Insight     The algorithm counts the total number of adjacent character pairs that are identical, which corresponds to the minimum number of deletions required to eliminate all consecutive duplicates.
# Interview   Before: "I could use a stack to track characters and pop duplicates." After: "A linear scan is more efficient at O(n) time and O(1) space, as we only need to compare each character with its immediate predecessor to identify necessary deletions."
# Pitfalls    (1) Failing to handle empty strings or single-character strings, which the code explicitly guards against to return zero.  (2) Incorrectly indexing the loop by starting at zero instead of one, which would cause an index out of bounds error when accessing the previous character.

The HackerRank link is the first row so you can jump back to the problem anytime.

How PrepPush captures submissions

PrepPush runs only on hackerrank.com — including contest and prep-kit pages.

When your submission is accepted:

PrepPush captures the solution from HackerRank's submission data
It pushes to your GitHub repo (it can create the repo on first push if your token allows)
Optionally, Gemini adds technique, Big-O, trick, and hint in the header

A small toast appears on the page when capture succeeds. Open the extension from your toolbar if you want to see status or the AI analysis — push and analysis still run in the background either way.

One-time setup (~2 minutes)

You bring your own keys. PrepPush does not host your code or credentials.

1. GitHub personal access token

Create a classic token with repo scope Generate token on GitHub
Expiration: 90 days or No expiration — your choice
Paste it in PrepPush Settings → Test GitHub

2. Gemini API key (optional)

Only needed if you want AI notes in the file header.

Free tier: Google AI Studio
Paste in PrepPush Settings → Test AI

That's it. Submit an accepted solution and check your repo.

Why I built it as an extension (not a script)

HackerRank doesn't give you a clean "export all my solutions" button for the workflow I cared about.

I needed something that:

Fires on Accepted — not on Run/Compile
Works on full-screen and prep-kit URLs
Writes to my repo structure, not a third-party server

A Chrome extension made sense: local keys, no PrepPush backend, you own the data.

What I learned shipping it

Early users helped a lot. A few real-world fixes:

SQL / DB2 problems needed correct file paths (.sql, not .py)
Prep-kit pages use different APIs than classic challenges — capture had to follow both
AI headers had to reference your actual code, not generic interview tips

It's a small project (~50 early users) but it solves a real problem for me every week.

Limitations (honest list)

Topic	Notes
Platform	HackerRank only — not LeetCode or Codeforces
Trigger	Submit Code → Accepted — Run Code doesn't count
Keys	You provide GitHub token + optional Gemini key
Privacy	Keys stay in Chrome on your device — see privacy notes

Try it

Chrome Web Store: Install PrepPush
Source / issues: github.com/tridibbanik17/PrepPush
Demo video: YouTube walkthrough

If you use HackerRank for interview prep, I'd love feedback — what breaks, what's missing, what would make this a weekly habit for you.

PrepPush is an independent project. Not affiliated with HackerRank, GitHub, or Google.

Question for you: How do you track HackerRank solutions today — GitHub, Notion, or not at all? I'd love to hear what would make this workflow stick for you.