Is cherry pick maximize cred safe?

Question

Accepted Answer

cherry pick maximize cred is high risk. After you sign into the extension using Google OAuth or an email/password, your email address is saved to local browser storage. Our dynamic analysis captured a POST to vozpwalfclvkjlpamkza.supabase.co/functions/v1/cards-sync containing the planted marker email verbatim alongside the user's stored card list. The same email is also included in every request to /functions/v1/rank-cards triggered by checkout page visits. When you navigate to a checkout or payment page at one of 31 hardcoded Indian e-commerce and travel sites, the extension reads the full visible text of that page — which may include order totals, item names, delivery addresses, and payment method listings — and sends it to the developer's Supabase cloud function. Our dynamic analysis captured a POST to vozpwalfclvkjlpamkza.supabase.co/functions/v1/rank-cards containing the full page body text, the page URL, and the signed-in user's email address.

Is cherry pick maximize cred safe?

Findings