Is AutoSBC safe?

Medium risk

AutoSBC sends FUT player inventory snapshots and market price data to its own servers, with upload behavior controlled by a remote config.

When a user clicks the diagnostic button, AutoSBC collects a detailed snapshot of the player inventory, SBC state, automation settings from localStorage, and the user's Discord display name, then transmits this to autosbc.app. Separately, when the remote config enables uploads and the user has market logging on (default), the extension intercepts FUT market search results and periodically posts player IDs, names, ratings, and market prices to autosbc.app. The upload frequency and activation threshold are determined server-side via a config file fetched at startup.

AutoSBCv27.0.4Firefox Add-ons
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Diagnostic upload sends AutoSBC inventory and settings to autosbc.app.

MediumunwantedCWE-200Dynamic sandbox

When you click AutoSBC's diagnostic button, the extension sends a diagnostic report to autosbc.app.

What actually happens

You did this

You click the diagnostic button in the AutoSBC SBC panel.

The extension did this

AutoSBC builds a diagnostic snapshot with player inventory, localStorage automation settings, and SBC state, then sends it to its diagnostic endpoint.

Captured request

POSThttps://www.autosbc.app/api/diagnostic

Fields in the request

  • SBC page and inventory data
    club inventory and current SBC squad data (illustrative)

    Shows the player's club, transfer, storage, unassigned, and locked item state plus current SBC set, challenge, squad, and requirements.

  • AutoSBC browser storage settings
    autosbc:autoautosbc and autosbc:settings values (illustrative)

    Includes saved automation, market filter, loop, meter, onboarding, and settings values from localStorage.

What it can do

Permissions this extension asks for, as declared in version 27.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on www.autosbc.app

    https://www.autosbc.app/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed AutoSBC contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.autosbc.app

    AutoSBC sends data to www.autosbc.app. No other extension we have analyzed sends data here.

Updated 2 November 2026amo-2840821