Is Innfinergy v5.06 safe?

Medium risk

Innfinergy v5.06 fetches remote Firebase settings that control automatic features on Innergy pages.

On startup and every hour, the extension downloads innfinergy.json from innfinergyreport-default-rtdb.firebaseio.com and saves it as Inf_StoredConfig. That JSON is merged into the local feature configuration, and enabled automatic features run on app.innergy.com and internal*.innergy.dev pages using configured functions and same-origin request templates.

pluto700v5.06Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

A public Firebase feed picks which internal function runs on Innergy pages

The service worker fetches a Firebase Realtime Database file with no authentication and caches it.

A content script on Innergy pages then reads the cached file and calls whichever internal function it names for each enabled feature.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open app.innergy.com, or any internalN.innergy.dev instance, while logged in.

The same fetch also runs on extension startup and on an hourly background alarm, independent of any page being open.

The extension did this

The extension requests a Firebase hosted JSON file with no authentication and stores it in local browser storage.

A content script on the Innergy page then reads that stored file and calls the function name it lists for every feature marked enabled.

Captured request
GEThttps://innfinergyreport-default-rtdb.firebaseio.com/innfinergy.json

200 OK, approximately 1.6KB of JSON listing feature definitions (including entries such as F103, F110 and F123). Observed during dynamic analysis fetched with no Authorization header and no API key on the request.

Fields inside one feature entry (schema shared with the bundled default list)
  • Function to run
    KanbanDates

    Names an internal function that executes on the Innergy page once this feature is enabled.

  • Feature ID
    F103

    Identifies which entry in the remote file a given override applies to.

  • Runs automatically
    true

    Lets the function fire on every matching page load without a click.

  • Pages it applies to
    /kanban

    Restricts, or leaves unrestricted, which Innergy URL paths the function fires on.

The code that does this

Config fetch, then dispatch to the named function

Readable version

UpdateMainData(): fetch with no auth header, cache the result

backgroundV3.js
async function UpdateMainData(x, callback) {    let filterKeyMoneyValue = function (value) { // @%& replaced with $ globaly , ForceOverwriteCommand:true overwrites whole object,  eArray = []        return value.replace(/@%&/g, "$");    }    let firebase_Data = JsonTryParse(filterKeyMoneyValue(await promisify(fetchPage)("https://innfinergyreport-default-rtdb.firebaseio.com/innfinergy.json"))); if (firebase_Data === false) { callback(false); return; }    console.log("Updated Main Data")    console.log(new Date())    console.log(firebase_Data)    chrome.storage.local.set({        Inf_StoredConfig: firebase_Data    }, function () {        console.log("saved")        if (callback != null) callback();    });}

RunPerformance(): dispatch to the function the config names

content.js
if (!options.enabled) { continue; } //skip feature if globaly disabled by profileswitch (type) {    case "manual":        if (!getSettingContext("manual", options).set) { continue; }        break;    case "auto":        if (!getSettingContext("auto", options).set) { continue; }        break;    default:        continue;}let setFunction = window[options.function];if (!setFunction) { continue; }options.messageData = message;options.globalSettings = Main_Data.globalSettings;let skipItem = false;RunSafemode({ opt: options, f: setFunction }, function (result) {    if (result === "skip") {        skipItem = true;    }});if (skipItem === true) ranItems++;
Reproduce it yourself

Fetches the same remote config the extension reads on every startup and hourly refresh, so you can confirm no login or API key is required and see how many feature entries it currently returns.

Requires
  • Node.js 18+ (built in fetch)
innergy-config-check.js · js
// innergy-config-check.js// Fetches the same remote config the Innfinergy extension loads on every// startup and hourly refresh, with no authentication, and reports what// it currently contains. Requires Node.js 18+ (built in fetch).const CONFIG_URL = "https://innfinergyreport-default-rtdb.firebaseio.com/innfinergy.json";async function main() {  const res = await fetch(CONFIG_URL, { method: "GET" });  console.log(`HTTP ${res.status} ${res.statusText}, no credentials sent`);  const text = await res.text();  const normalized = text.replace(/@%&/g, "$"); // same substitution the extension applies  const data = JSON.parse(normalized);  const features = data.features || {};  const ids = Object.keys(features);  console.log(`Feature entries returned: ${ids.length}`);  for (const id of ids.slice(0, 10)) {    const f = features[id];    console.log(`  ${id}: function=${f.function} enabled=${f.enabled} auto=${f.auto}`);  }}main().catch((err) => {  console.error("Request failed:", err.message);  process.exit(1);});
How to run it
  1. 1node innergy-config-check.js
Where the config is served from
    • innfinergyreport-default-rtdb.firebaseio.com

    Vendor-operated Google Firebase Realtime Database. Serves the feature config that decides which internal function runs on Innergy pages, read with no authentication.

What it can do

Permissions this extension asks for, as declared in version 5.06. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed Innfinergy v5.06 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • app.innergy.com

    Innfinergy v5.06 sends data to app.innergy.com. No other extension we have analysed sends data here.

  • internal1.innergy.dev

    Innfinergy v5.06 sends data to internal1.innergy.dev. No other extension we have analysed sends data here.

  • internal2.innergy.dev

    Innfinergy v5.06 sends data to internal2.innergy.dev. No other extension we have analysed sends data here.

  • internal3.innergy.dev

    Innfinergy v5.06 sends data to internal3.innergy.dev. No other extension we have analysed sends data here.

  • internal4.innergy.dev

    Innfinergy v5.06 sends data to internal4.innergy.dev. No other extension we have analysed sends data here.

  • internal5.innergy.dev

    Innfinergy v5.06 sends data to internal5.innergy.dev. No other extension we have analysed sends data here.

Updated 30 September 2026ajdehnbmilfnjbfhffbjdmkohamimpjo