Is Depop Bot - Bump | Refresh your Listings safe?
Depop Bot - Bump sends Depop access tokens to its Cloud Functions backend when creating relisting videos.
When a user creates a relisting video, the extension posts the Depop access token along with the user ID, video URL, thumbnail URL, and Firebase token to its Cloud Functions backend. If the user sends a bug report, it also uploads the current Depop page URL and the page's full HTML to the same backend.
Who publishes itSubversive Labs, LLC - no other listings under this identity
Subversive Labs, LLC - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.0.20. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on depop.com
*://*.depop.com/*
Watch every request your browser makes
webRequest
Where it sends data
Destinations our analysis observed Bump contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- us-central1-depop-extension.cloudfunctions.net
Bump sends data to us-central1-depop-extension.cloudfunctions.net. No other extension we have analysed sends data here.