Is Auto BCC for Gmail™ safe?

Medium risk

Auto BCC for Gmail sends saved Auto BCC rules and cached Gmail sender choices with support requests.

When a user submits feedback, the extension sends the typed issue and optional contact email to its feedback API. The same request also includes saved Auto BCC rules, cached Gmail sender choices, browser user agent, extension version, and an extension client ID.

revja0189v1.10.0Chrome Web Store
45Risk
Who publishes it

revja0189 - 4 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
revja0189

Same store account

4 other listings published from this account, 13k+ users between them, none of them carrying a finding.

HBO Max Dual Subtitles - Subtitle Translator5k+CleanCR Dual Subtitles - Subtitle Translator3k+LowPrime Video Dual Subtitles - Subtitle Translator3k+CleanDailymotion Dual Subtitles - Subtitle Translator2k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Feedback sends saved Auto BCC rules to the support API

When you submit feedback in Auto BCC for Gmail, it posts your issue and email to api-g.iamheretoassistyou.cc, plus saved Auto BCC rules, cached Gmail sender choices, user agent, and a client ID, though the UI only labels issue and email.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user submits the extension feedback form.

The extension did this

The extension posts the typed feedback together with saved Auto BCC rules and cached Gmail sender choices to the support API.

Captured request
POSThttps://api-g.iamheretoassistyou.cc/api/feedback2
Fields in the request
  • Saved extension settings
    rules and fromContacts values from extension storage (illustrative)

    Stored Auto BCC rules and cached sender choices can describe how the user configured Gmail automation.

  • Feedback form entries
    Issue text with optional user@example.com contact email (illustrative)

    The issue text and optional email address can identify the user's support request and contact details.

What it can do

Permissions this extension asks for, as declared in version 1.9.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.10.0, which we have not unpacked yet.

  • Read and change your data on mail.google.com

    https://mail.google.com/

  • Read and change your data on inbox.google.com

    https://inbox.google.com/

  • Read and change your data on autobcc.org

    https://*.autobcc.org/

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Auto BCC for Gmail™ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api-g.iamheretoassistyou.cc

    Auto BCC for Gmail™ sends data to api-g.iamheretoassistyou.cc. 2 other extensions we have analysed send data here.

Updated 30 September 2026iipfmjlcofmggdhmbldfinigaaediplo