Is Amplitude Event Explorer safe?
Amplitude Event Explorer intercepts all outgoing browser requests to extract analytics payloads and can activate full DOM session recording on any page.
The extension's service worker reads the body of every outgoing web request across all websites to capture Amplitude analytics event data and API keys from request headers. When test mode is enabled by the user, the content script activates rrweb-based session recording at 100% sample rate, capturing DOM mutations, clicks, and form interactions and transmitting them to Amplitude's servers. The extension also reads Amplitude cookies on startup and can capture full DOM snapshots of any page and proxy them to app.amplitude.com.
Who publishes itAmplitude - 1 other listing from the same operator, none carrying a finding
Amplitude - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 1 listing
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Session replay on all pages when test mode is enabled
Opening the popup, enabling Test Mode with session replay on, plus an Amplitude key entered, starts the content script, already in every tab, recording DOM mutations, clicks, form input via rrweb.
Batches go to Amplitude at 100% sample.
What actually happens
You open the extension popup, enter an Amplitude API key, and enable Test Mode with Session Replay turned on.
This sends a popup:setTestModeConfig message to every content script currently injected into open tabs.
The content script on the active tab immediately starts recording everything that happens on the page and sends it to Amplitude.
rrweb captures DOM mutations, clicks, scroll events, and text input at 100% sample rate; recordings are POSTed to api-sr.amplitude.com in gzip-encoded batches.
Captured request
during dynamic analysis captured 9 POST requests on en.wikipedia.org, bodies ranging from 189 B to 356 KB. Requests originated from source=cs (content script).
- Content-Type
- application/json
{"version":1,"events":[<gzip-encoded rrweb event stream>]}The code that does this
Session replay plugin initialization at 100% sample rate
function activateSessionReplay(config) { if (!hI.instance) return; if (config.isEnabled && config.enableSessionReplay) { // sampleRate:1 = 100% of sessions recorded const replayPlugin = createSessionReplayPlugin({ sampleRate: 1, storeType: 'memory', useWebWorker: true }); hI.instance.add(replayPlugin); hI.sessionReplayPlugin = replayPlugin; } else if (hI.sessionReplayPlugin) { hI.instance.remove(hI.sessionReplayPlugin.name); hI.sessionReplayPlugin = null; }}Data captured by rrweb and transmitted to Amplitude
- DOM mutations{"type":3,"data":{"source":2,"texts":[{"id":47,"value":"search query text"}]}}
Every change to the page structure, text typed, elements added or removed, modal dialogs opening, is recorded as it happens.
- Click and input events{"type":3,"data":{"source":5,"id":102,"x":312,"y":448}}
Mouse clicks and keyboard input on non-password form fields are captured, showing which UI elements you interact with.
- Scroll position{"type":3,"data":{"source":3,"x":0,"y":1240}}
Scroll depth and viewport position are recorded throughout the session.
- Page URLhttps://en.wikipedia.org/wiki/Main_Page
The URL of the page being recorded is included in each session batch sent to Amplitude.
Hosts receiving recorded session data
- api-sr.amplitude.com
Receives rrweb session replay batches. Run by Amplitude, Inc. (acquired by Confluent 2024). Data lands in the Amplitude project tied to the entered API key.
- sr-client-cfg.amplitude.com
Returns per-project privacy masking config (defaultMaskLevel, urlMaskLevels, capture_enabled, sample_rate). Masking depends on the operator's settings.
Scope and activation caveat
Session replay only activates when a user with access to the extension popup explicitly enables it, enters a valid Amplitude API key, and toggles Session Replay on. The recording scope is limited to the tab where the content script is active at activation time; however because the content script is injected into all HTTP/S pages (*://*/*), any tab can become a recording target. Password, off-screen, file, email, and tel input fields are excluded by the shouldTrackEventResolver filter (inject.bundle.js line 60322). Privacy masking beyond that exclusion list depends on the remote config returned by sr-client-cfg.amplitude.com for the specific Amplitude project.
Where it sends data
Destinations our analysis observed Amplitude Event Explorer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api2.amplitude.comwidely used
Amplitude Event Explorer sends data to api2.amplitude.com. A widely used service: 42 other extensions we have analyzed send data here.
- api.amplitude.com
Amplitude Event Explorer sends data to api.amplitude.com. 13 other extensions we have analyzed send data here.
- api-sr.amplitude.com
Amplitude Event Explorer sends data to api-sr.amplitude.com. One other extension we have analyzed sends data here.
- app.amplitude.com
Amplitude Event Explorer sends data to app.amplitude.com. No other extension we have analyzed sends data here.
- sr-client-cfg.amplitude.com
Amplitude Event Explorer sends data to sr-client-cfg.amplitude.com. No other extension we have analyzed sends data here.