Is Hackertab – Dev News & GitHub in New Tab safe?

Medium risk

Hackertab starts Sentry Replay in its new-tab UI with unmasked text and media and default PII enabled.

When the Hackertab new-tab page loads, it initializes Sentry Replay for sampled sessions and error sessions. The recorded replay data can include visible page text, media, and form or search input from the extension UI, and is sent to Sentry's ingest endpoint.

Mehdi Sakoutv1.26.7Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Hackertab's new-tab page streams unmasked on-screen text to Sentry

Opening Hackertab's new-tab page starts a Sentry session replay with text and media masking off.

We forced an error and captured a recording of on-screen article text sent to Sentry unmasked.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab, loading the Hackertab dashboard UI.

The extension did this

The extension starts a Sentry session replay recorder with text and media masking turned off, before the page renders.

Sentry Replay is initialized with maskAllText:false and blockAllMedia:false immediately before the new-tab React app mounts.

The code that does this

Sentry Replay initialization, called immediately before the new-tab UI renders

Readable version
const SENTRY_DSN =  "https://7240b0956e82c99c9901b4de789e77f0@o55264.ingest.us.sentry.io/4509652330807296";const initSentry = () => {  Sentry.init({    dsn: SENTRY_DSN,    sendDefaultPii: true,    enabled: true,    integrations: [      Sentry.replayIntegration({        maskAllText: false,        blockAllMedia: false,      }),    ],    replaysSessionSampleRate: 0.01,    replaysOnErrorSampleRate: 1,  });};// called right before the new-tab React app mountsinitSentry();const root = ReactDOM.createRoot(rootElement);root.render(<App />);
Captured request
POSThttps://o55264.ingest.us.sentry.io/api/4509652330807296/envelope/?sentry_version=7&sentry_key=7240b0956e82c99c9901b4de789e77f0&sentry_client=sentry.javascript.react%2F9.38.0

The envelope carried a replay_event item plus a 73,362-byte zlib-compressed replay_recording stream. Decoding the stream yielded 78 rrweb DOM events. Among them, the on-screen new-tab feed text ('poteto/hiring-without-whiteboards', 'Bring any AI agent into Slack, Teams & Discord. Open-source.') appears verbatim and unmasked. Text typed into the search box in the same recording appeared masked as asterisks rather than the real characters.

What the Sentry replay recording contains
  • Page text on screen
    poteto/hiring-without-whiteboards

    Article headlines and descriptions you are currently viewing are captured exactly as they appear on screen.

  • Typed search or chat input
    **********

    Text you type into the search box or AI chat input is captured by the same recorder, but shown as asterisks, not real characters.

  • Replay sampling
    replaysSessionSampleRate: 0.01, replaysOnErrorSampleRate: 1

    Sets how often a full session recording is captured and sent versus only on an unhandled error.

Where the recording goes
    • o55264.ingest.us.sentry.io

    Receives Sentry Session Replay recordings from the extension's new-tab UI, including unmasked on-screen text. Operated by Sentry (Functional Software, Inc).

Where it sends data

Destinations our analysis observed Hackertab – Dev News & GitHub in New Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • o55264.ingest.us.sentry.io

    Hackertab – Dev News & GitHub in New Tab sends data to o55264.ingest.us.sentry.io. No other extension we have analysed sends data here.

Updated 30 September 2026ocoipcahhaedjhnpoanfflhbdcpmalmp