Is Dupe.com safe?

Question

Is Dupe.com safe?

Accepted Answer

Dupe.com is medium risk. Separately from the Google Analytics page-view tracking the extension already performs, Dupe.com's background service worker builds a second, richer event every time you view a product-detail page on a shopping site: the product's URL, title, price, currency, brand, category, selected size/color, seller, SKU, rating, and review count, plus a session ID and either your signed-in Dupe account ID or a persistent temporary ID if you're signed out. This event is queued and sent to a Tinybird analytics endpoint using a bearer token that is hardcoded identically into every install, not a per-user credential. The behavior sits behind a remote feature flag the extension checks on startup; in dynamic testing we enabled that flag, visited a real Amazon product page, and captured the resulting request landing at the Tinybird endpoint with the fields described here. We could not determine what fraction of installs currently have the flag turned on.

Is Dupe.com: Find similar products for less safe?

Findings