XT-Neros
Open-source Ghost Session Protocol that protects Roblox session cookies from theft.
01 // OVERVIEW
Overview
XT-Neros is a Manifest V3 Chrome extension that protects the Roblox session cookie. It removes the .ROBLOSECURITY cookie from the browser cookie jar and injects it at the network layer, so malware, malicious extensions and XSS payloads cannot read it. MIT licensed; formerly XT-KRYPTOS v2.
02 // PROBLEM
Problem
The .ROBLOSECURITY cookie is the master key to a Roblox account — possession is authentication. Cookie managers leave it in the jar, exactly where malware and extensions look. XT-Neros removes it from that surface entirely.
03 // APPROACH
Approach
A zero-trust, compartmentalised design: no single component holds both the ciphertext and the means to decrypt it. The cookie lives encrypted in a vault and is reapplied only as live request headers.
04 // ARCHITECTURE
Architecture
A layered trust hierarchy. A background guardian performs operations and is the only component that momentarily sees plaintext; the cookie never re-enters the cookie jar and is never exposed to page JavaScript or browser APIs.
05 // IMPLEMENTATION
Implementation
Vault, network-level injection protocol and hygiene guidance are complete and in daily use, published as an MIT-licensed Chrome extension repository.
06 // FINDINGS
Findings
The protection flow is proven in daily use. The public edition derives from the private XT-KRYPTOS core, stripped to the auditable essentials.
07 // LIMITATIONS
Limitations
Chromium-family focus; store distribution and broader platform testing remain pending.