Is CardVault safe?
CardVault stores payment cards and lets any *.vercel.app page trigger its automated card-change flow and read visited-site names.
CardVault keeps a card vault and automatically opens supported merchant sites to enter the stored card. Its external messaging bridge accepts requests from any page on *.vercel.app without checking the sender. Such a page can ask which supported sites you have visited more than three times, or start the card-change flow and control the opened tabs, though card details are only typed into the vendor's target sites.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes it2 other listings from the same operator, none carrying a finding
2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 5k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed CardVault contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.cardlift.co
CardVault sends data to api.cardlift.co. No other extension we have analysed sends data here.