Is Coupons.com | Shopping with Savings safe?
Coupons.com collects hotel booking details, including guest name and email, from confirmation pages and sends them to Directo.
A bundled Directo SDK runs on all websites and recognises booking confirmation pages of many hotel and travel brands. On a match it reads the reservation reference, guest name, email, property, prices and stay dates, and for some brands the full page HTML. This is sent with session and user IDs to events.getdirecto.com.
Who publishes itCuponation CN GmbH - 1 other listing from the same operator, none carrying a finding
Cuponation CN GmbH - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 20k+ users between them, none of them carrying a finding.
Shared hosts - 11 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Directo SDK reads guest name, email and booking ref on hotel confirmation pages
Code analysis shows the extension reads guest name, email and booking reference from hotel confirmation pages and sends them to events.getdirecto.com along with session and user IDs.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a booking confirmation page, for example on hyatt.com/book/confirm/.
No click or consent step is involved.
The extension reads your name, email and booking reference and sends them to events.getdirecto.com.
Some partners also send the full page HTML.
Reservation record assembled by each partner tracker
Dispatch from the tracker manager
public/chunks/vendors.jsconst t = await this.getTrackerForUrl(e);if (t && await t.isReservation()) { const n = await t.getReservationDetails(); const o = await In.getSessionId(), r = await ut(); if ("html" === t.parserType) { In.sendConversionHTMLEvent({ ...n, clean_html: n.clean_html, session_id: o, user_id: r }); } else In.sendConversionEvent({ ...n, clean_html: null, session_id: o, user_id: r });}Background worker POST routes
background.bundle.jsF = U.makeZodOpenApiRoutePost(() => "/v2/conversion-details", j.B64Json)(C),q = U.makeZodOpenApiRoutePost(() => "/v2/conversion-details-html", j.Json)(C)sendConversionEvent: async (e, t) => { await F({ body: e }) },sendConversionHTMLEvent: async (e, t) => { await q({ body: e }) }- Guest nameJordan Ellis
Name shown on the booking, read from the page.
- Guest emailjordan.ellis@example.com
Email address attached to the booking.
- Booking referenceHY48213907
Confirmation number for the stay.
- Reservation URLhttps://www.hyatt.com/book/confirm/HY48213907
Full address of the confirmation page.
- Stay and price2026-11-03 to 2026-11-06, 2 adults
Check-in, check-out, guests, hotel and totals.
- Session and user IDa3f1c9e2-7b64-4d0e-9c21-5e8a1d7f3b02
Identifiers that link the record to this browser.
- events.getdirecto.com
Receives /v2/conversion-details (base64 JSON) and /v2/conversion-details-html (JSON with page HTML).
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Coupons.com | Shopping with Savings contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- events.getdirecto.com
Coupons.com | Shopping with Savings sends data to events.getdirecto.com. One other extension we have analysed sends data here.