| 1 | Code Injection | high | background.js (line 63) | Background service worker programmatically injects scripts into the MAIN world of arbitrary tabs (with `<all_urls>` host permission) to install the fetch/XHR interceptor. MAIN-world injection escapes the extension's iā¦ | |
| 2 | Data Exfiltration | high | utils/apiService.js (line 6) | Captured API traffic ā including full request headers (Authorization, Cookie, X-Api-Key), request bodies, response headers, and response bodies ā is shipped in batches of 50 to the third-party server `api.apisecapps.cā¦ | |
| 3 | Data Exfiltration | high | utils/apiService.js (line 6) | Uploads full captured HTTP traffic ā URLs, request/response headers (which can include Authorization/Cookie tokens), and request/response bodies ā to the vendor's backend at api.apisecapps.com. This is the documented ā¦ | |
| 4 | Data Exfiltration | high | utils/apiService.js (line 6) | Captured API traffic ā including full URLs, request/response headers (which contain Authorization, Cookie, x-api-key, Set-Cookie) and full request and response bodies ā is uploaded in 50-item batches to a third-party ā¦ | |
| 5 | Network Interception | high | content/responseBodyInterceptor.js (line 7) | This MAIN-world content script monkey-patches window.fetch and XMLHttpRequest.prototype.open/send on monitored tabs to silently capture every HTTP response body (up to 512KB) and forward it via window.postMessage to aā¦ | |
| 6 | Network Interception | high | content/responseBodyInterceptor.js (line 7) | Injected into the MAIN world with injectImmediately:true, this monkey-patches window.fetch and XMLHttpRequest.prototype.open/send for every page the user visits while capture is active, cloning every response body up ā¦ | |
| 7 | Unauthorized Data Collection | high | core/webRequestListeners.js (line 89) | Registers webRequest listeners on `<all_urls>` capturing request bodies, request headers (including Authorization/Cookie), and response headers for every request the browser makes. Combined with the MAIN-world responsā¦ | |
| 8 | Code Injection | medium | panel.js (line 8635) | The panel takes the captured HTTP response body of an arbitrary observed request and uses chrome.scripting.executeScript to call document.open()/document.write() in the active tab, replacing the page's DOM with attackā¦ | |
| 9 | Code Injection | medium | background.js (line 63) | Programmatically injects code into MAIN world with injectImmediately:true so the page's own JS sees a pre-patched fetch and XMLHttpRequest. Combined with <all_urls> host permissions and the tab auto-add logic in chromā¦ | |
| 10 | Code Injection | medium | panel.js (line 7898) | Uses chrome.scripting.executeScript with <all_urls> permission to run document.open()/document.write() on the user's active tab, injecting an arbitrary captured response body as HTML into the tab's origin. Any scriptsā¦ | |
| 11 | Credential Theft | medium | utils/tokenAnalyzer.js (line 235) | Specifically extracts bearer tokens, API keys, JWTs, and session cookies from intercepted Authorization, x-api-key, x-auth-token, x-access-token, and Cookie headers. Also scans response bodies for fields named access_ā¦ | |
| 12 | Credential Theft | medium | utils/apiService.js (line 169) | Sends the user's Cognito ID token (a JWT containing email and identity claims) to the apisecapps.com backend as the `api_key` body parameter. This passes a bearer-equivalent identity token in a non-standard body fieldā¦ | |
| 13 | Data Exfiltration | medium | utils/apiService.js (line 6) | Captured HTTP traffic ā including request/response headers (Authorization, Cookie, Set-Cookie), request bodies, and response bodies ā is uploaded to the vendor's cloud endpoint api.apisecapps.com when the user clicks ā¦ | |
| 14 | Data Exfiltration | medium | utils/apiService.js (line 6) | Captured request/response data ā including full headers and bodies ā is uploaded to the vendor's backend at api.apisecapps.com in batches of 50. While this matches the extension's stated purpose of API discovery and Oā¦ | |
| 15 | Data Exfiltration | medium | utils/apiService.js (line 44) | Uploads full captured traffic ā URLs, request/response headers (including Authorization, Cookie, x-api-key), request bodies, and response bodies ā to a remote third-party endpoint at api.apisecapps.com. Although this ā¦ | |
| 16 | Network Interception | medium | content/responseBodyInterceptor.js (line 7) | MAIN-world script monkey-patches window.fetch and XMLHttpRequest.prototype.open/send on every monitored page (injected via chrome.scripting.executeScript with injectImmediately:true and world:'MAIN'). It clones every ā¦ | |
| 17 | Network Interception | medium | content/responseBodyInterceptor.js (line 7) | The extension monkey-patches window.fetch and XMLHttpRequest in the MAIN world of every page (<all_urls>) to capture full response bodies (up to 512KB) including JSON, text, and HTML. While this is the documented captā¦ | |
| 18 | Network Interception | medium | background.js (line 63) | Programmatically injects a MAIN-world content script that monkey-patches fetch/XHR on arbitrary tabs (host permission is <all_urls>). injectImmediately + MAIN world ensures the patch lands before the page's own scriptā¦ | |
| 19 | Network Interception | medium | content/responseBodyInterceptor.js (line 54) | Replaces window.fetch and XMLHttpRequest.prototype.open/send in the page's MAIN world to read response bodies (up to 512KB) and forward them via window.postMessage. This intercepts every request the page makes, includā¦ | |
| 20 | Network Interception | medium | core/webRequestListeners.js (line 89) | Registers webRequest listeners against <all_urls> with `requestBody`, `requestHeaders`, and `responseHeaders` extra info specs. This gives the background service worker visibility into every cross-origin request body ā¦ | |
| 21 | Network Interception | medium | content/responseBodyInterceptor.js (line 7) | Monkey-patches window.fetch and XMLHttpRequest in the MAIN world (injectImmediately=true) on monitored tabs to capture full response bodies (up to 512KB) of arbitrary cross-origin API calls and posts them out via windā¦ | |
| 22 | Tracking | medium | panel.js (line 358) | The panel phones home to an n8n webhook on every open, sending a persistent install UUID, install date, version, active-days counter, A/B cohort, and feature events. The server response carries a `gateStatus` field thā¦ | |
| 23 | Unauthorized Data Collection | medium | core/webRequestListeners.js (line 89) | Registers webRequest listeners over <all_urls> with requestBody, requestHeaders, and responseHeaders extraData, capturing the full HTTP request/response metadata of every navigation. Combined with the MAIN-world body ā¦ | |
| 24 | Unauthorized Data Collection | medium | core/webRequestListeners.js (line 92) | Registers webRequest listeners over <all_urls> with the requestBody, requestHeaders, and responseHeaders extra info specs. This grants the background worker visibility into every HTTP request body, every request headeā¦ | |
| 25 | Unauthorized Data Collection | medium | core/webRequestListeners.js (line 89) | Registers webRequest listeners on <all_urls> with requestBody, requestHeaders and responseHeaders extraInfoSpec, capturing request bodies, Authorization/Cookie headers and Set-Cookie response headers on every URL whilā¦ | |
| 26 | Code Injection | low | panel.js (line 8739) | In the Manipulator's "display response in tab" action, the extension calls chrome.scripting.executeScript on the active tab and injects the raw response body via document.write into the page DOM. The body content origā¦ | |
| 27 | Credential Theft | low | utils/cognitoAuth.js (line 6) | Sign-in is performed inside the side panel against AWS Cognito directly, and on the `newPasswordRequired` challenge the code silently completes the challenge by re-using the user's submitted password instead of promptā¦ | |
| 28 | Credential Theft | low | utils/cognitoAuth.js (line 139) | When Cognito requests a forced password change (NEW_PASSWORD_REQUIRED), the client silently re-submits the same password the user just typed to satisfy the challenge instead of prompting. This defeats the purpose of tā¦ | |
| 29 | Data Exfiltration | low | utils/apiService.js (line 6) | Captured HTTP traffic ā including full URLs, request/response headers and bodies ā is uploaded to api.apisecapps.com in batches of 50. Authorization headers, session cookies, and PII present on the monitored domain wiā¦ | |
| 30 | Network Interception | low | core/webRequestListeners.js (line 89) | Registers chrome.webRequest listeners against <all_urls> with the requestBody/requestHeaders/responseHeaders extra-info specs, giving the extension visibility into request bodies, request/response headers (including Aā¦ | |
| 31 | Network Interception | low | core/webRequestListeners.js (line 89) | The extension registers webRequest listeners on <all_urls> that capture full request bodies, request headers, and response headers from every tab. This is the core mechanism for the product's stated purpose (deriving ā¦ | |
| 32 | Other | low | utils/cognitoAuth.js (line 87) | On Cognito's NEW_PASSWORD_REQUIRED challenge the extension silently re-submits the user's existing password to complete the challenge instead of prompting for a new one. This bypasses the intended forced-password-reseā¦ | |
| 33 | Other | low | utils/cognitoAuth.js (line 41) | JWT identity claims are decoded and trusted without any signature verification. A tampered ID token could spoof the user identity used by the extension's UI and downstream API calls. Low-severity because the token stiā¦ | |
| 34 | Tracking | low | panel.js (line 358) | The panel sends usage telemetry (event name, persistent install UUID, version, install date, dismissed-message id, active-days counter, A/B cohort) to an n8n.cloud webhook on every panel open and feature interaction. ā¦ | |
| 35 | Tracking | low | panel.js (line 357) | Phones home to an n8n.cloud webhook with a randomly generated install ID, install date, version, and per-event metadata (panel opens, signups, feature gate triggers, cohort assignment). The data is anonymous and the iā¦ | |
| 36 | Tracking | low | panel.js (line 341) | On install the background generates a persistent random UUID (`boltInstallId`) and install date (background.js:22), and the panel sends them with every analytics event including A/B cohort and active-days counter. Thiā¦ | |
| 37 | Tracking | low | panel.js (line 295) | On every panel open the extension POSTs an anonymous-analytics payload (install ID, version, install date, active days, event type, cohort) to an n8n.cloud webhook and acts on the response. Server-controlled fields arā¦ | |
| 38 | Tracking | low | panel.js (line 125) | The extension phones home to an n8n.cloud webhook on every panel open and user action, sending a persistent install UUID, install date, version, active-day counter and event metadata. While the code comments and a priā¦ | |
| 39 | Unauthorized Data Collection | low | panel.js (line 2020) | User signup/registration form data (first name, last name, work email, company) is POSTed directly from the extension to a HubSpot Forms endpoint for marketing/CRM ingestion. This is consistent with the visible signupā¦ | |
| 40 | Unauthorized Data Collection | low | panel.js (line 2018) | User-supplied registration data (email and consent flags collected by the gate form) is POSTed directly to a HubSpot Forms submission endpoint from the extension. While disclosed via consent text, this routes user PIIā¦ | |
| 41 | Unauthorized Data Collection | low | panel.js (line 1924) | Submits the user-entered registration data (email, name, company, license-agreement consent) directly to a HubSpot Forms endpoint with the page context tagged as `apisec.ai/sign-up`. Standard SaaS marketing-funnel behā¦ | |
