Is ChurchBee safe?
ChurchBee is medium risk. When you open the ChurchBee email builder, it creates a remote iframe on email-builder.my.bee.church with an access token in the URL, then exchanges messages with that frame including stored user data and the generated email content.…
Who publishes itFlund Ministry - no other listings under this identity
Flund Ministry - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
ChurchBee sends email-builder tokens to a remote iframe.
When you open the ChurchBee email builder, it creates a remote iframe on email-builder.my.bee.church with an access token in the URL, then exchanges messages with that frame including stored user data and the generated email content.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
The user launches the ChurchBee email builder feature.
The extension loads a remote email-builder iframe with an access token and exchanges builder messages with it.
- Generated email content<table>Weekly bulletin</table> (illustrative)
HTML or page content can reveal what the user is composing in the email builder.
- Stored user data{"memberId":"12345","organizationId":"67890"} (illustrative)
The stored user object can identify the account using the builder and connect activity to that account.
User action tags are sent to ChurchBee tagging API.
When you use ChurchBee features such as exporting an email, it can send a member tag to my.bee.church/api/tagging.
DB evidence shows the tag request includes stored account data, including the church account name for the account-name event.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You complete a ChurchBee action that requires tagging.
The extension sends a member action tag with stored account-related data to ChurchBee's tagging API.
- Stored account dataFirst Community Church (illustrative)
Account values saved by the extension, including the CCB account name for the account-name tag event, can be included with the member tag.
ChurchBee injects its scripts into every HTTP page you visit.
When you navigate with ChurchBee installed, it injects content scripts into HTTP pages in every tab, not just ccbchurch.com.
That gives the extension access to the page URL and DOM content on unrelated sites during normal browsing.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate to an HTTP page in a tab.
ChurchBee injects its content scripts into that page, including pages unrelated to ccbchurch.com.
- Your browsing URLhttps://www.example.com/account (illustrative)
Identifies the site and page where the extension code was injected.
- Page DOM contentPage text and form elements (illustrative)
Includes page text and elements that the injected content script can access on the visited page.
Observed during dynamic analysis on five unrelated sites, where ChurchBee loaded content script assets on each tested page rather than limiting injection to ccbchurch.com.