Is cherry pick maximize cred safe?

High risk

cherry pick maximize cred is high risk. After you sign in via Google OAuth or email/password, your email is saved locally. Dynamic analysis captured it in a POST to the cards-sync endpoint beside the stored card list, and in every checkout-triggered rank-cards request.…

v1.35Chrome Web Store
78Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Signed-in email address sent to developer backend on every checkout

After you sign in via Google OAuth or email/password, your email is saved locally.

Dynamic analysis captured it in a POST to the cards-sync endpoint beside the stored card list, and in every checkout-triggered rank-cards request.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You sign into the extension with your Google account or email/password.

Sign-in is handled via Supabase auth in profile.js using the hardcoded anon JWT.

The extension did this

Your email address is written to chrome.storage.local and subsequently included in every POST to the developer's backend on checkout page visits.

Once stored, the email is read automatically by the service worker without any further user interaction.

Captured request
POSThttps://vozpwalfclvkjlpamkza.supabase.co/functions/v1/cards-sync

200 OK, returns updated card list if server copy has changed

Headers
Content-Type
application/json
Body
{  "source": "extension",  "email": "a planted marker email address",  "storedCards": [    {      "bank": "SBI",      "name": "SBI Cashback Card"    }  ],  "updatedAt": "2020-01-01T00:00:00.000Z"}
What's stored on your device

After sign-in, the extension stores your email and Supabase tokens locally, reading the email on every checkout visit for outbound requests.

Location
chrome.storage.local
Contents
{  "email": "priya.sharma@gmail.com",  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",  "refresh_token": "v1.refresh.abc123xyz"}
The code that does this

Email persisted to storage after Google OAuth (profile.js lines 5314-5318)

Readable version
await chrome.storage.local.set({ email: session.user.email, access_token: accessToken, refresh_token: refreshToken }); chrome.tabs.update({ url: `chrome-extension://${chrome.runtime.id}/profile.html` });
The code that does this

Email read and sent in cards-sync and rank-cards (background.js lines 9-24 and 1437-1447)

Readable version
// syncStoredCards() — called on every checkout visit const stored = await chrome.storage.local.get("email"); if (!stored.email) return; const userEmail = stored.email; const payload = { source: "extension", email: userEmail, storedCards: storedCards, updatedAt: lastUpdated }; await fetch("https://vozpwalfclvkjlpamkza.supabase.co/functions/v1/cards-sync", { method: "POST", body: JSON.stringify(payload) });
Endpoints that receive the user's email
    • vozpwalfclvkjlpamkza.supabase.co

    Developer-controlled Supabase project. Receives your email via /functions/v1/cards-sync (card sync) and /functions/v1/rank-cards (checkout analysis) on every matching navigation.

Checkout page content and URL transmitted to developer backend

At checkout on 31 hardcoded Indian e-commerce and travel sites, the extension reads the full page text, which can include totals, item names, addresses, and payment methods, and sends it to the developer's Supabase function.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You visit a checkout or payment page on Flipkart, Amazon.in, Myntra, or 28 other supported sites.

Matching is done against a hardcoded list of 31 exact URLs and a generic checkout-path pattern.

The extension did this

The extension reads the full page text and POSTs it, along with your email and stored cards, to the developer's cloud backend.

The POST goes to vozpwalfclvkjlpamkza.supabase.co/functions/v1/rank-cards on every matching page navigation.

Captured request
POSThttps://vozpwalfclvkjlpamkza.supabase.co/functions/v1/rank-cards

200 OK, returns ranked card recommendations object

Headers
Content-Type
application/json
Body
{  "pageUrl": "https://www.flipkart.com/checkout",  "pageTitle": "flipkart checkout",  "pageContent": "flipkart assured cash on delivery available ... items in your cart ... sbi cashback card ... enter delivery address ...",  "cards": [    {      "name": "SBI Cashback Card",      "bank": "SBI"    }  ],  "email": "a planted marker email address"}
Fields transmitted to rank-cards endpoint
  • Full page text
    flipkart checkout ... add new address ... sbi cashback card ... cod available ...

    The complete visible text of the checkout page, lowercased, including item names, prices, shipping address fields, and payment options.

  • Checkout URL
    https://www.flipkart.com/checkout

    The exact URL of the payment page you are on, identifying the merchant and your cart state.

  • Account email
    priya.sharma@gmail.com

    Your email address as stored after sign-in, included in every request if you are signed into the extension.

  • Stored card list
    [{"name":"SBI Cashback Card","bank":"SBI"}]

    The list of credit/debit cards you have saved in the extension, sent alongside the page content for ranking.

The code that does this

Content script payment detection and data extraction (content.js lines 38-92)

Readable version
const paymentGateways = ["sdk.cashfree.com", "fastrr-boost-ui.pickrr.com/assets/images", "cdn.shopify.com/shopifycloud/checkout-web", "sdk.breeze.in/gallery/icons", "pgi.billdesk.com"]; const checkoutUrls = ["https://www.vegnonveg.com/checkout", "https://www.amazon.in/gp/buy/payselect/handlers/display.html", "https://www.flipkart.com/checkout", "https://www.myntra.com/checkout/payment", ...28 more]; // On match: chrome.runtime.sendMessage({ isPaymentPage: true, pageTitle: document.title.toLowerCase(), pageContent: document.body.innerText.toLowerCase(), url: window.location.href });
The code that does this

Service worker rank-cards POST (background.js lines 1437-1459)

Readable version
const stored = await chrome.storage.local.get("email"); let userEmail; if (stored.email) { userEmail = stored.email; await syncStoredCards(); // also sends email + cards to /cards-sync } const storedCards = (await chrome.storage.sync.get(["storedCards"])).storedCards || []; const payload = { pageUrl: event.url, pageTitle: event.pageTitle, pageContent: event.pageContent, cards: storedCards, email: userEmail }; await fetch("https://vozpwalfclvkjlpamkza.supabase.co/functions/v1/rank-cards", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) });
Where checkout page data is sent
    • vozpwalfclvkjlpamkza.supabase.co

    Developer-controlled Supabase project. Receives checkout page text, URL, email, and card list on every matching navigation. Also hosts /cards-sync, syncing saved cards.

Behavioral telemetry with email and card names sent to Mixpanel

The extension uses a hardcoded Mixpanel token to send analytics to api.mixpanel.com.

Captured POSTs set distinct_id to the user's email (or a random ID if signed out), with events naming saved cards and checkout URLs.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You interact with the extension, opening the popup, adding a card, visiting a checkout page, or starting the browser.

Multiple events are instrumented throughout background.js and popup.js.

The extension did this

The extension sends an analytics event to Mixpanel containing a distinct_id tied to your email address or a persistent random identifier.

Events include card names, checkout URLs, and gateway detection results, all tied to the same persistent identity across sessions.

Captured request
POSThttps://api.mixpanel.com/track

200 OK

Headers
Accept
text/plain
Content-Type
application/json
Body
[  {    "event": "Payment Page Detected",    "properties": {      "url": "https://www.flipkart.com/checkout/",      "gatewayFound": false,      "foundInPage": true,      "foundInScript": false,      "token": "dd89a1b5134eee35a1acbf9ac4e6722f",      "distinct_id": "<planted-marker-id>",      "time": 1746016800    }  }]
Data included in every Mixpanel event
  • Project token
    dd89a1b5134eee35a1acbf9ac4e6722f

    A hardcoded identifier that routes all events into the developer's Mixpanel project. This token cannot be rotated by users.

  • Persistent user identity
    priya.sharma@gmail.com

    Your email if signed in, otherwise a random ID that persists across browser restarts. Mixpanel uses this to link all your events over time.

  • Saved card names
    SBI Cashback Card | HDFC Regalia | Axis Flipkart

    Included in Synced Cards events as a pipe-separated string of the card names stored in the extension.

  • Checkout page URL
    https://www.flipkart.com/checkout/

    Included in Payment Page Detected events, revealing which merchants you shop at and when.

The code that does this

Mixpanel tracking function in background.js (lines 1339-1369)

Readable version
async function trackEvent(eventName, props = {}) { const payload = [{ event: eventName, properties: { ...props, token: "dd89a1b5134eee35a1acbf9ac4e6722f", distinct_id: await new Promise(resolve => { chrome.storage.sync.get(["email", "userId"], data => { if (data.email) resolve(data.email); else if (data.userId) resolve(data.userId); else { const newId = "user_" + Math.random().toString(36).substr(2, 9); chrome.storage.sync.set({ userId: newId }, () => resolve(newId)); } }); }), time: Math.floor(Date.now() / 1000) } }]; fetch("https://api.mixpanel.com/track", { method: "POST", headers: { "Content-Type": "application/json", Accept: "text/plain" }, body: JSON.stringify(payload) }); }
Analytics destination
    • api.mixpanel.com

    Mixpanel analytics platform (Mixpanel, Inc.). Receives behavioral events including card names, checkout URLs, and a persistent user identity tied to the signed-in email address.

Updated 21 September 2026ebankejienamjhfeecfcloemnggddgbf