Is Grammar Checker and AI tool - Correcto safe?
Correcto is medium risk. Opening the upgrade panel resolves your IP via pro.ip-api.com with a hardcoded API key. The country code is sent to correctoai.com as X-Client-Region to set pricing, undisclosed in the listing or privacy policy, regardless of purchase.
Who publishes itproduct-development-correcto - no other listings under this identity
product-development-correcto - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
IP Address Sent to Geolocation API When Opening Products Panel
Opening the upgrade panel resolves your IP via pro.ip-api.com with a hardcoded API key.
The country code is sent to correctoai.com as X-Client-Region to set pricing, undisclosed in the listing or privacy policy, regardless of purchase.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension's products or upgrade panel.
This fires a GET_CORRECTO_PRODUCTS message to the background service worker.
The extension calls pro.ip-api.com with your real IP address before fetching product pricing.
Function hu() resolves your IP to a country code using a hardcoded commercial API key, then passes that code to correctoai.com in the X-Client-Region header.
Hardcoded API key and geolocation fetch in background.js
const Yt = { IP_API_KEY: "UrAgFKkI0mHyBiA"};const hu = async () => { try { const e = `https://pro.ip-api.com/json/?key=${Yt.IP_API_KEY}&fields=country,countryCode`, t = await fetch(e); if (!t.ok) throw new Error(`Error de HTTP: ${t.status}`); return (await t.json()).countryCode } catch (e) { x(e, { extra: { message: "Error fetching geo info", url: "https://pro.ip-api.com/json/" } }) }};const mu = async () => { const e = await hu() ?? "US", t = { "X-Client-Region": e }, n = await v(St({ url: `${bt}/api/rest/1_0/products/`, customHeaders: t })); // ...};- Your IP address203.0.113.47
Your real IP address is the origin of the HTTP request to pro.ip-api.com and is visible to that service.
- Hardcoded API keyUrAgFKkI0mHyBiA
A commercial pro.ip-api.com API key is embedded verbatim in the extension source, associating all lookups with a single registered account.
- Country / country codeES
The resolved country code is returned and forwarded to correctoai.com as the X-Client-Region header.
- pro.ip-api.com
Commercial IP geolocation API. Receives the user's real IP on every products-panel open; resolves it to country and country code. Operated by ip-api.com.
Confirms the hardcoded API key is present in the extension source and that pro.ip-api.com accepts it.
- bash
- curl
- python3
#!/usr/bin/env bash# Verify the hardcoded pro.ip-api.com key in Correcto (hllekbchnfikjpbdielihahenjmbpach)# Usage: bash verify-ip-api-key.sh /path/to/deobfuscated/background.jsBG="${1:-background.js}"KEY=$(grep -oP 'IP_API_KEY:\s*"\K[^"]+' "$BG" | head -1)echo "Key found in source: $KEY"curl -s "https://pro.ip-api.com/json/?key=${KEY}&fields=country,countryCode" | python3 -m json.tool- 1Locate the deobfuscated background.js.
- 2Run: bash verify-ip-api-key.sh background.js.
- 3It prints the key from source, requests pro.ip-api.com with it, and prints the JSON response, including your resolved country code.
What it can do
Permissions this extension asks for, as declared in version 11.135.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Run its own code inside the pages you visit
scripting
Show a panel beside the page
sidePanel