Tracking Auditor Chrome extension security report

Yet another debugger extension. Tracking Auditor is a lightweight Chrome DevTools extension that records and shows requests of the inspected tab, including GA4 transports that common debuggers might miss. The goal is narrow: "detect requests, read parameters, even if a Google Tag Gateway, Stape custom loader or custom path is used". As a focused "gap-filler" (not a replacement for David Vallejo's excellent Analytics Debugger) it started as a personal tool for quick debugging in those edge cases where no typical request format / path is used for GA4 requests. But as most marketing setups include other client-side tags, I added more formats instead of switching between several "Pixel Helpers" (see list of services and monitored request types below). This Extension adds a "Tracking Auditor" tab to DevTools when installed. How To Use ========== Hit Start & Reload — the page reloads and every hit is listed in blocks per navigation, in order, with event name, parameters, a user-data summary and (where present) the consent state decoded. A collapsible "Record" settings row switches services on/off (capture), and an independent "Show" filter row (service checkboxes + fulltext) narrows the displayed log. Scope ===== GA4: - Standard GA4 (`google-analytics.com` / `analytics.google.com`, `/g/collect`) - First-party sGTM / Google Tag Gateway (`/g/collect` / `/collect` with `v=2` & `tid=G-…`) - Stape Custom Loader (GA4 path base64-encoded inside a query parameter) - Plaintext custom delivery paths (cryptic path without `collect`, but `v=2` & `tid=G-…` & `en`) Meta (Facebook) Pixel: - Standard pixel (`facebook.com/tr`, GET beacon or form POST) - First-party proxied `/tr` on the site's own domain Bing / Microsoft UET: - Standard tag (`bat.bing.com/action` / `actionp`) and first-party proxied `/action` - Reads `asc` consent signal ("granted/denied" or "unset" to mark a missing asc signal) TikTok Pixel: - Standard pixel (`analytics.tiktok.com/api/v2/pixel` POST JSON, `/act` batch) and the base64 transport (payload base64-encoded in `?analytics_message=`) - Reads `event`/`context.pixel.code`, advanced matching, e-commerce, Events API dedup (`event_id`), and TikTok's own data-quality verdict Pinterest Tag: - Standard tag (`ct.pinterest.com/v3/` GET beacon, POST for large payloads). The `/user` endpoint (subset only) is ignored. - Reads `tid`/`event`, enhanced match, e-commerce, custom fields, Conversions API dedup and region flag Google Ads: - Conversion (`googleadservices.com/pagead/conversion` · `/ccm/conversion`, first-party `google.com/pagead/1p-conversion`), remarketing/audience (`doubleclick.net/pagead/viewthroughconversion` · `google.com/rmkt/collect` · `/pagead/1p-user-list`), measurement (`google.com/ccm/collect`, `tid=AW-…`) and enhanced-conversions UPD (`/pagead/form-data` · `/ccm/form-data`) - One user action fans out across many mirrored transports — they are folded into a single card per "logical hit" (`×N transports`), anchored on the conversion id - Reads conversion data, enhanced-conversion data, dynamic-remarketing product data / line items consent. Pure Privacy-Sandbox / telemetry pings are filtered out. LinkedIn Insight Tag: - Standard beacon (2 x `px.ads.linkedin.com/collect`) folded into a single card, page views and conversions - Reads partner id, conversion id (if present) - The `/attribution_trigger` (redundant) and `/wa/` (gzip POST) endpoints are ignored