Settings-change watchdog for SaaS admin panels

The idea

A browser extension that watches specific pages inside the SaaS admin panels your team already uses — an AWS IAM console, a Stripe dashboard, a GitHub organization settings page — and takes a periodic snapshot of the parts that matter (permissions, billing email, webhook URLs, 2FA requirements). When a snapshot differs from the last one, it diffs the change and posts it to a Slack channel or webhook: who's logged in, what page, what changed, old value versus new. No agent on the server, no API integration to maintain — it just watches the DOM the way a human would if they refreshed the page every hour.

Why build this

Full audit logging is usually locked behind the most expensive tier of a SaaS product, or it exists but nobody looks at it because it's buried in a console nobody opens. A five-person startup on GitHub Team or Stripe's standard plan often has no practical way to know that someone quietly disabled required 2FA, changed the payout bank account, or added a new IAM policy — until something breaks or a customer complains. This tool doesn't need vendor cooperation or an API key with elevated scopes; it works against whatever the logged-in user can already see in their browser, which makes it viable for admin panels that have no audit API at all.

Stack sketch

• Chrome/Firefox extension, Manifest V3, content scripts scoped to a small allowlist of URL patterns per supported site
• Background service worker handles diffing and scheduling (chrome.alarms for periodic re-checks on open tabs, plus a "check now" on tab focus)
• IndexedDB in the extension for local snapshot history — no snapshot ever leaves the machine except the diff itself
• Per-site "adapter" config: a JSON file per vendor mapping CSS selectors to human-readable field names (e.g. #billing-email → "Billing email")
• Outbound alert via Slack Incoming Webhook or a generic HTTPS webhook, sent directly from the background worker
• Optional: a tiny self-hosted relay (single Go or Node binary) for teams who want alerts deduplicated across multiple people's browsers instead of one per teammate

Scope for v1

• Support exactly three adapters: GitHub org settings (Danger Zone + member roles), Stripe dashboard (payout details, team members), AWS IAM console (policies attached to a chosen user/role)
• Manual "watch this page" button per tab — no auto-discovery of admin panels
• Local diff history viewable in the extension popup, plus a Slack webhook alert on change
• One webhook URL configured per install, no multi-channel routing
• Out of scope: shared/team-synced alert history, automatic adapter discovery, support for arbitrary user-defined selectors, mobile browsers

Where it could go

The obvious next step is turning adapter configs into a small community-maintained registry — a JSON file per vendor that users can drop in without waiting for a new extension release, so support for Notion, Vercel, or Cloudflare shows up as a config PR rather than a code change. After that, the self-hosted relay becomes more central: instead of every teammate's browser firing its own webhook, snapshots get pushed to a shared backend that dedupes across the team, keeps a real timeline per admin panel, and can layer on "who else was watching this page" context. A stretch goal is read-only screenshot diffs (not just text) for settings pages that render state as toggles or icons rather than text nodes.

Watch out for

DOM scraping is inherently brittle — a vendor redesign silently breaks a selector, and a broken selector that fails quietly is worse than no monitoring at all, so v1 needs a loud "this adapter stopped matching, snapshot skipped" alert rather than silent failure. It's also not a replacement for real audit logs where those exist and are affordable; position it explicitly as a stopgap for panels that don't offer one.