Is InTruth safe?
InTruth is high risk. Entering an Anthropic API key and starting a fact check makes InTruth send it in an x-api-key header to https://intruth-backend.vercel.app/api/claude. Shipped code uses that backend, though the manifest also grants Anthropic's API host.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
InTruth forwards your Anthropic API key to its backend
Entering an Anthropic API key and starting a fact check makes InTruth send it in an x-api-key header to https://intruth-backend.vercel.app/api/claude.
Shipped code uses that backend, though the manifest also grants Anthropic's API host.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You enter an Anthropic API key and click Start Fact-Checking.
The popup saves the key before sending the start message to the extension's service worker.
The extension sends that key to its backend in an x-api-key request header.
The first Claude warmup request is sent to intruth-backend.vercel.app/api/claude after the service worker loads the saved key.
- Your Anthropic API keysk-ant-api03-7nQp9wR2mLx6YcVbT4eHk1sA
The credential you provide for Claude requests. If another service receives it, that service can make requests authorized by your key.
- Request header namex-api-key
The key is carried as a request header instead of staying only inside your browser session.
- Anthropic API version2023-06-01
The request also identifies the Anthropic API version the extension expects the backend to use.
- x-api-key
- <redacted>
- Content-Type
- application/json
- anthropic-version
- 2023-06-01
The shipped code stores the user key and forwards it to the backend
Readable summary of the shipped key flow
src/popup/popup.js and src/background/service-worker.js// The extension package does not include a separate deobfuscated directory.// The shipped JavaScript is already readable, so this summarizes the same code path.// 1. The popup reads the Anthropic key from the input field.const anthropicKey = anthropicEl.value.trim();// 2. The popup stores it as chrome.storage.local.anthropicKey.chrome.storage.local.set({ anthropicKey, transcriptLanguage: languageEl.value });// 3. The service worker copies that value into ANTHROPIC_KEY.ANTHROPIC_KEY = data.anthropicKey || '';// 4. Claude requests are POSTed to InTruth's backend with the key in a header.fetch('https://intruth-backend.vercel.app/api/claude', { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': ANTHROPIC_KEY, 'anthropic-version': '2023-06-01' }});- intruth-backend.vercel.app
Receives Claude POST requests from the extension with the user-supplied Anthropic API key in the x-api-key header.
- api.anthropic.com
Declared in the extension's host permissions, but the active service worker code shown here sends Claude requests through the InTruth backend endpoint.