Developer trust is the foundation of ClaudeCash. Other ad-in-editor tools have faced serious security criticism — including being classified as adware for patching Anthropic's own extension files directly on disk. We built ClaudeCash with a strict extension-only model: no file patching, no unsigned updates, no code access.
🔒
No file patching
ClaudeCash never modifies files outside its own extension sandbox. We do not touch Anthropic's Claude Code extension, VS Code internals, or any AI tool files. Your editor is exactly as it was before installation.
✅
Signed updates via VS Code Marketplace
Every ClaudeCash update is published through the official VS Code Marketplace and signed by Microsoft's extension infrastructure. There are no background auto-updates, no unsigned payloads, and no connections to external update servers.
🚫
No access to your code or prompts
ClaudeCash reads only the AI tool's status indicator — the spinner state that tells it whether the AI is thinking. It never reads your files, your Claude prompts, or any AI responses.
🧹
Clean uninstall
Uninstalling ClaudeCash removes it completely. No residual CSP modifications, no background processes, no cached files. Your editor returns to its exact pre-installation state.
📊
Minimal data collection
We collect your email address (for sign-in) and impression counts (to calculate earnings). No keystrokes, no file contents, no prompt text, no AI responses, no browsing activity.
👁️
Open source
The ClaudeCash extension is open source. You can review every line of code before installing. There are no obfuscated scripts, no encoded payloads, and no server-side code that runs on your machine.
When your AI tool enters a thinking state, the ClaudeCash extension detects the status change using the VS Code extension API (the same API used by themes and linters). It sends a single POST request to our server with:
Impressions are rate-limited server-side: maximum 1 per 5 seconds per API key, maximum 2,000 per day. All verification happens on our server — client-supplied data is never trusted without server validation.