Is Denote safe?

Question

Is Denote safe?

Accepted Answer

Denote is high risk. Our dynamic analysis confirmed that version 1.0.27.9 added a window.fetch override to facebook-early-interceptor-readable.js. On any page whose URL contains facebook.com/ads/library, the hook intercepts every fetch() call to /api/graphql, /api/graphql/, /ajax/bz*, /ajax/bootloader*, or any URL containing /api/ or graphql. It clones the response, strips Facebook's for(;;); security prefix, and parses the JSON to extract ad objects using the same extraction logic as the XHR hook. New ads are deduplicated against window.__denote_captured_data.ads and dispatched to the content script via the same CustomEvent and postMessage channels. The URL check for both the XHR and fetch hooks was widened in this version from /ads/library/ (requiring a query string) to /ads/library (bare path), expanding the interception surface. When you use the extension's save action, it packages scraped ad creative details and page context for Denote's save/upload APIs. The request goes to Denote endpoints such as https://denote.net/api/v1/ext/save-creative with creative metadata, URLs, and stored X-Token and NC-Token authentication headers.

Is Denote: Save Ads TK & FB Ad Library safe?

Findings