Is Free Bulk Sender for Messenger ⚡️ by AI safe?

Medium risk

Free Bulk Sender for Messenger sends WhatsApp bulk-message task details and AI prompts to vendor endpoints.

When a user starts a WhatsApp bulk-message campaign, the extension posts recipient phone numbers, message bodies, timing settings, and related task details to its Firebase Cloud Functions analytics endpoint. If the AI message generator is used, it sends the prompt to OpenAI and logs the user's name, WhatsApp phone number, prompt, and generated text to api.tecrave.org.

técravev3.6.5Chrome Web Store
46Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AI message prompts and WhatsApp identifiers are sent to Tecrave logging API

When you use the AI message generator, the extension sends your prompt and the generated text to api.tecrave.org.

The logged request also includes your WhatsApp name and phone number alongside the message content.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user clicks the AI generation control and submits a prompt.

The extension did this

The extension logs the prompt, generated text, WhatsApp name, and WhatsApp phone number to api.tecrave.org.

Captured request
GETapi.tecrave.org/whatsapp/log
Fields in the request
  • AI message prompt
    Write a friendly follow-up message (illustrative)

    The text you enter for message generation can reveal the message content you want the extension to produce.

What it can do

Permissions this extension asks for, as declared in version 3.6.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on wasender.ai

    https://wasender.ai/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed Free Bulk Sender for Messenger ⚡️ by AI contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.openai.comwidely used

    Free Bulk Sender for Messenger ⚡️ by AI sends data to api.openai.com. A widely used service: 57 other extensions we have analysed send data here.

  • us-central1-waplugin-34798.cloudfunctions.net

    Free Bulk Sender for Messenger ⚡️ by AI sends data to us-central1-waplugin-34798.cloudfunctions.net. 2 other extensions we have analysed send data here.

  • api.tecrave.org

    Free Bulk Sender for Messenger ⚡️ by AI sends data to api.tecrave.org. No other extension we have analysed sends data here.

Updated 21 September 2026ngnfgjiffkdnaealddiedjnohhdndjan