Is FastApply - Free AI Automated Job Application Copilot safe?
FastApply sends page error telemetry from most pages where its content script runs to its API.
FastApply installs a content script across a broad set of pages and listens for page errors and unhandled promise rejections. When one occurs, it sends the error message and the current page URL, with query strings removed, to FastApply's telemetry endpoint.
Who publishes itzionekekenta - no other listings under this identity, 10 shared hostnames
zionekekenta - no other listings under this identity, 10 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 10 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
FastApply sends the page URL where a script error fires to its telemetry API
FastApply's content script runs on almost every site you visit.
When a page throws a JavaScript error or a rejected promise, we observed the page's URL sent to FastApply's own telemetry server along with the error text.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You browse a site outside FastApply's five excluded webmail domains and something on the page throws a JavaScript error.
FastApply's content script sends the page's URL and the error text to FastApply's own telemetry server.
The background service worker strips the URL's query string first, but keeps the site's host and full path.
HTTP 201 from api.fastapply.co. Captured during dynamic analysis on a live job-board page after a genuine, unforced script error, not a planted test error. A second independent run captured the same behavior on https://fastapply.co/for/auto-fill.
{ "events": [ { "platform": "unknown", "action": "crash", "success": false, "errorType": "uncaught_error", "errorMessage": "Uncaught SyntaxError: Identifier ... has already been declared", "pageUrl": "https://jobs.lever.co/aledade", "extensionVersion": "9.1" } ]}- Page URL (host + path)https://jobs.lever.co/aledade
The address of the page open when the error fired, sent even when that page has nothing to do with a job application.
- Error message textUncaught SyntaxError: Identifier ... has already been declared
The JavaScript error text is stored alongside the page URL.
- Error typeuncaught_error
Marks whether the error was an uncaught exception or a rejected promise.
- Extension version9.1
Lets FastApply correlate the error report with a specific release.
When a batch threshold is hit · flushes at 10 queued events
Queued error events are held locally and uploaded together once 10 events accumulate or 30 seconds pass, whichever comes first.
- api.fastapply.co
FastApply's own backend telemetry endpoint. Receives the page URL and error text from any site where the content script runs and an error fires.
Forces a JS error on the current tab so you can watch the resulting POST to FastApply's telemetry endpoint in DevTools.
- Chrome with FastApply installed and enabled
- DevTools open on the target tab
// Run in the DevTools console of any normal HTTPS tab (not one of the// five excluded webmail domains) while FastApply is installed and enabled.setTimeout(() => { throw new Error("fastapply-verify-test");}, 0);// Then open DevTools > Network on this tab, filter for "telemetry", and// wait up to 30 seconds (or trigger 9 more errors to force an immediate// flush). Look for a POST to// https://api.fastapply.co/api/v1/telemetry/events whose body includes an// event with pageUrl set to this tab's current URL, query string stripped.- 1Open DevTools on a non-webmail HTTPS page with FastApply active.
- 2Paste the script into Console.
- 3Open the Network tab, filter for 'telemetry'.
- 4Wait up to 30s and confirm the POST body's pageUrl matches this page.
Where it sends data
Destinations our analysis observed FastApply - Free AI Automated Job Application Copilot contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.fastapply.co
FastApply - Free AI Automated Job Application Copilot sends data to api.fastapply.co. No other extension we have analysed sends data here.