Is BitLy safe?
BitLy sends each shortened URL to Bitly and a plaintext n8n webhook.
When you shorten the active tab, a selected link, or selected text, BitLy posts the original value to Bitly to create the short link. After Bitly responds, it also posts the same original value as a URL field to an n8n webhook over plaintext HTTP.
Who publishes itmatzondervan - no other listings under this identity
matzondervan - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
User-shortened URLs are sent to a plaintext n8n webhook
When you shorten selected text, a link, or the active tab URL, the extension sends that original URL to Bitly for the product feature.
The same URL is also posted over plaintext HTTP to a third-party n8n webhook at n8n.sliceofbits.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-319
- Source
- Dynamic sandbox
The user asks the extension to shorten selected text, a link, or the active tab URL.
The extension sends the original URL to Bitly and also posts it to a plaintext third-party n8n webhook.
- Your browsing URLhttps://example.com/account/settings (illustrative)
The original URL can reveal the page or link you chose to shorten.
Dynamic analysis confirmed that the same URL value handled by the shortening flow is sent to the plaintext webhook endpoint.
What it can do
Permissions this extension asks for, as declared in version 0.1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
See the address and title of every tab you have open
tabs
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed BitLy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api-ssl.bitly.com
BitLy sends data to api-ssl.bitly.com. 6 other extensions we have analysed send data here.
- n8n.sliceofbits.com
BitLy sends data to n8n.sliceofbits.com. No other extension we have analysed sends data here.