Is Bonbon Rewards safe?

Medium risk

Bonbon Rewards is medium risk. Code analysis shows the extension sends a cleaned copy of the page body, plus hostname and path, to api.onsleek.io when a site is on a server-supplied list.

v2025.0.29.1744Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sleek SDK uploads page DOM snapshots and URLs to api.onsleek.io on listed sites

Code analysis shows the extension sends a cleaned copy of the page body, plus hostname and path, to api.onsleek.io when a site is on a server-supplied list.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a cart or product page on a site the Sleek server lists.

The list comes from /v1/allowlist-websites and /v2/websites.

The extension did this

The extension copies the visible page content and sends it to api.onsleek.io.

Hostname and path are sent alongside the page content.

The code that does this

getCartTotal captures the DOM and POSTs it

Readable version

Transport helper Ne

background.js
Authorization: `Bearer ${s}`,"x-sleek-sdk-version": vu...n && i && (l["Content-Encoding"] = "gzip");let d = new URL(r ? `${c}${e}` : `${u}${e}`);
Fields in the cart-total request body
  • Page content
    <div class="cart"><span>Subtotal $84.99</span>...</div>

    A copy of the page body with scripts and styles removed.

  • Site hostname
    www.bestbuy.com

    Which site you are on.

  • Page path
    /cart

    Which page on the site you are viewing.

  • Session id
    c1f0b7e2-5a3d-4a6e-9b1c-3e2d8f7a9c10 (illustrative)

    Links requests from one visit together.

Where the page content goes
    • api.onsleek.io

    Sleek API; receives simpleDom, hostname and pathname.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Updated 15 October 2026bffloiinjildpmfeojkncjnilljclgdh