Is Drag & Input safe?
Drag & Input sends selected form context and nearby page HTML to its AI provider when users generate answers.
When a user uses the Shift or Command drag workflow, the extension collects the selected input, select, radio, and checkbox elements plus sanitized nearby page HTML. It builds that context into an AI prompt and sends it to the default Drag & Input Gemini endpoint, or to OpenAI or Google Gemini when the user configures a personal provider.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 5.6.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on api.openai.com
https://api.openai.com/*
Read and change your data on generativelanguage.googleapis.com
https://generativelanguage.googleapis.com/*
Read and change your data on drag-and-input-438923.an.r.appspot.com
https://drag-and-input-438923.an.r.appspot.com/*
Read and change your data on localhost:3000
http://localhost:3000/*
Store data in your browser
storage
Show you desktop notifications
notifications
Where it sends data
Destinations our analysis observed Drag & Input contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.openai.comwidely used
Drag & Input sends data to api.openai.com. A widely used service: 57 other extensions we have analysed send data here.
- generativelanguage.googleapis.comwidely used
Drag & Input sends data to generativelanguage.googleapis.com. A widely used service: 31 other extensions we have analysed send data here.
- drag-and-input-438923.an.r.appspot.com
Drag & Input sends data to drag-and-input-438923.an.r.appspot.com. No other extension we have analysed sends data here.