Is App Studio safe?

Medium risk

App Studio sends popup search and download activity with a persistent install ID to an n8n webhook.

When you search in the popup, App Studio sends the search term and result count to a Venture Crew n8n webhook together with a persistent install ID, extension version, platform, and timestamp. When you click a download result, it sends the selected file ID, slug, and name to the same webhook. The popup also loads a kt.gtw.vc banner iframe that includes the current search keyword in its URL.

EVCv1.1.0Chrome Web Store
45Risk
Who publishes it

Entire VC - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
EVC
Declared legal entity
Entire VC
Registered address
1111B S Governors Ave STE 28805, Dover, DE 19904-6903, US
Registered contact
Entire VC Inc
Website
maombi.com/platform-desktop/os-windows/pages/maombi-chrome-extension/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup sends app search keywords to kt.gtw.vc banner iframe

Searching for an app in App Studio makes the popup load a banner iframe from kt.gtw.vc, with the typed keyword and popup URL context in the iframe URL, so the remote host receives the search text on search or result actions.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user searches for an app or interacts with a search result in the popup.

The extension did this

The extension loads a kt.gtw.vc banner iframe with the user's app search keyword in the query string.

Captured request
GEThttps://kt.gtw.vc/Xc1rhP
Fields in the request
  • Your app search keyword
    weather app (illustrative)

    Shows the remote banner host what app or term you searched for in the popup.

  • Popup URL context
    ?source=popup (illustrative)

    Adds page or popup URL parameters that can give context about where the banner request came from.

What it can do

Permissions this extension asks for, as declared in version 1.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on maombi.com

    https://maombi.com/*

  • Read and change your data on kt.gtw.vc

    https://kt.gtw.vc/*

  • Read and change your data on venturecrew.app.n8n.cloud

    https://venturecrew.app.n8n.cloud/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed App Studio contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • kt.gtw.vc

    App Studio sends data to kt.gtw.vc. No other extension we have analysed sends data here.

  • venturecrew.app.n8n.cloud

    App Studio sends data to venturecrew.app.n8n.cloud. No other extension we have analysed sends data here.

Updated 30 September 2026ngjmbeipokeakggdfblpmginaaikkgka