Is hrs_ext safe?

Question

Is hrs_ext safe?

Accepted Answer

hrs_ext is rated clean, though our review noted the following. On travel-booking pages matched by the extension (Concur, mykds.com, and cytric.net), the extension first fetches a per-company configuration from HRS's own API. When that configuration returns is_matomo_analytics_enabled=true, the extension loads HRS's Matomo tracker into the page and sends an analytics beacon to HRS's own web-analytics.hrs.com on every tracked page view and link click, carrying the page URL, page title, referring URL, a Matomo visitor ID, and screen/device fingerprint fields. We confirmed this transmission mechanism is real and functional by exercising the extension's own bundled tracking files directly and observing them construct and attempt to send this exact beacon with a planted marker value, which appeared verbatim in the outbound request. We could not directly confirm whether HRS's live configuration currently returns is_matomo_analytics_enabled=true for a specific corporate tenant, because all three manifest-matched booking platforms require an active corporate single sign-on session we do not have. The extension's Chrome Web Store listing does not mention analytics or tracking.

Is HRS Plug-in: Hotel Booking Experience safe?

Findings