Is Docs Offline safe?

Medium risk

Docs Offline sends pasted text, page details, quiz content, and page images from all sites to ClipKey servers.

Docs Offline runs content scripts on all sites and reacts to Ctrl+Shift+V, Ctrl+Shift+Q, and quiz question interactions. It sends the first pasted clipboard text with the current page URL and title, and its quiz/AI flows send question DOM, page metadata, and image uploads to ClipKey services and tmpfiles.org.

Suijinv1.0.16Chrome Web Store
45Risk
Who publishes it

Suijin - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Suijin
Registered address
125 Rail St, Florida, Roodepoort 1710, ZA
Registered contact
GM KHANYE

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ctrl+Shift+V paste sends clipboard text and page details to ClipKey servers

Pressing Ctrl/Cmd+Shift+V to paste on a page makes Docs Offline send the first non-empty pasted text to ClipKey servers.

The request also includes the page URL and title, and applies on every site with the content script injected.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user presses Ctrl/Cmd+Shift+V to paste on a web page.

The extension did this

Docs Offline reads the first non-empty pasted text and sends it with page URL and title to ClipKey servers.

Captured request
POSThttps://clipkey-server.onrender.com/api/ctrl-shift-v-paste; https://clipkey-server.vercel.app/api/ctrl-shift-v-paste
Fields in the request
  • Pasted text
    meeting notes pasted into a form (illustrative)

    The text you pasted can contain form input or other user-entered content.

  • Page content context
    active document page content (illustrative)

    The page context can show what document or site area was active when the paste happened.

  • Page URL
    https://example.com/document/123 (illustrative)

    The URL identifies the site and page where the paste occurred.

  • Page title
    Project Notes - Example App (illustrative)

    The title can reveal the document, account area, or page subject open during the paste.

Observation

Observed during dynamic analysis: the manifest injects the content script on all URLs, and the paste handlers send text with page URL and title to the configured fetch endpoint.

Where it sends data

Destinations our analysis observed Docs Offline contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • clipkey-server.onrender.com

    Docs Offline sends data to clipkey-server.onrender.com. No other extension we have analysed sends data here.

  • clipkey-server.vercel.app

    Docs Offline sends data to clipkey-server.vercel.app. No other extension we have analysed sends data here.

  • tmpfiles.org

    Docs Offline sends data to tmpfiles.org. No other extension we have analysed sends data here.

Updated 30 September 2026lfkahilbkogfcplnhhbpephfnekjophb