Is Jenni Web Importer safe?
Jenni is medium risk. Jenni Web Importer's page-detection flow sends the current page URL to PostHog analytics at us.i.posthog.com, exposing the imported page and adding browsing-history context to analytics events tied to a persistent ID.…
Who publishes itmarc - no other listings under this identity, 1 shared hostname
marc - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Page URL sent to PostHog analytics during detection.
Jenni Web Importer's page-detection flow sends the current page URL to PostHog analytics at us.i.posthog.com, exposing the imported page and adding browsing-history context to analytics events tied to a persistent ID.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user activates the extension's page-detection or floating-popup flow.
The extension sends a PostHog analytics event containing the current page URL.
- Current page URLhttps://example.com/article (illustrative)
Shows the specific page being processed by the extension.
- Browsing-history contextA sequence of imported page URLs (illustrative)
Repeated events can reveal which pages the user asked the extension to process.
PDF contents are sent to Jenni backend when saving a PDF reference
Saving a PDF reference sends the PDF file content to Jenni's backend at server-1044474498131.us-central1.run.app.
This is a user-required action transmitting document content as part of the PDF workflow.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You save a PDF reference in Jenni Web Importer.
The extension transmits the PDF file content to Jenni's backend server.
- PDF or page contentPDF text or page content (illustrative)
This can include the document or page content being saved into the reference workflow.
Dynamic analysis confirmed the add-to-library workflow uploads the PDF and sends the same file content for backend processing.
Jenni sends saved page text to its backend server.
Saving a web page reference collects the page URL and visible body text, then sends that content to Jenni's backend at server-1044474498131.us-central1.run.app for authenticated users.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user saves a web page reference.
Jenni Web Importer collects the page URL and visible page text, then transmits the content to its backend server.
- Page DOM contentExample Article Title and page text (illustrative)
The visible text and page HTML can include article text, form labels, profile details, or other content present when saved.
- Page URLhttps://example.com/research/article
The URL identifies the specific page being saved and can reveal browsing context tied to the reference.
Observed during dynamic analysis: saving a reference caused the extension to request page content from the content script and send it as fullHTML to the backend endpoint.