Is CrapApi Http Test safe?

CrapApi Http Test syncs your saved API requests, including headers and credentials, to its backend over unencrypted HTTP.

The extension is a Postman-style tool for testing REST and HTTP APIs from your browser. When you sync saved requests, it POSTs all your saved modules and interfaces, each carrying the URLs, parameters, and header strings you entered, to http://api.crap.cn over plain HTTP; saved headers often hold Authorization, Cookie, or API-key values, which travel unencrypted. After running a test request it also reads cookies for the target domain via chrome.cookies.getAll and shows them in its own debug panel, but those cookie values are not sent off the device.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.