Is Jenni Web Importer safe?

Medium risk

Jenni is medium risk. Jenni Web Importer's page-detection flow sends the current page URL to PostHog analytics at us.i.posthog.com, exposing the imported page and adding browsing-history context to analytics events tied to a persistent ID.…

marcv1.1.22Chrome Web Store
45Risk
Who publishes it

marc - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
marc
Website

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

scispace.com
Also called by 1 other listing: SciSpace

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Page URL sent to PostHog analytics during detection.

Jenni Web Importer's page-detection flow sends the current page URL to PostHog analytics at us.i.posthog.com, exposing the imported page and adding browsing-history context to analytics events tied to a persistent ID.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user activates the extension's page-detection or floating-popup flow.

The extension did this

The extension sends a PostHog analytics event containing the current page URL.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://us.i.posthog.com
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Current page URL
https://example.com/article (illustrative)Shows the specific page being processed by the extension.
Browsing-history context
A sequence of imported page URLs (illustrative)Repeated events can reveal which pages the user asked the extension to process.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

PDF contents are sent to Jenni backend when saving a PDF reference

Saving a PDF reference sends the PDF file content to Jenni's backend at server-1044474498131.us-central1.run.app.

This is a user-required action transmitting document content as part of the PDF workflow.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You save a PDF reference in Jenni Web Importer.

The extension did this

The extension transmits the PDF file content to Jenni's backend server.

02EvidenceNETWORK CAPTURE
Captured request
PUTserver-1044474498131.us-central1.run.app
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
PDF or page content
PDF text or page content (illustrative)This can include the document or page content being saved into the reference workflow.
04EvidencePLAIN NOTE
Observation

Dynamic analysis confirmed the add-to-library workflow uploads the PDF and sends the same file content for backend processing.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Jenni sends saved page text to its backend server.

Saving a web page reference collects the page URL and visible body text, then sends that content to Jenni's backend at server-1044474498131.us-central1.run.app for authenticated users.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user saves a web page reference.

The extension did this

Jenni Web Importer collects the page URL and visible page text, then transmits the content to its backend server.

02EvidenceNETWORK CAPTURE
Captured request
POSTserver-1044474498131.us-central1.run.app
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Page DOM content
Example Article Title and page text (illustrative)The visible text and page HTML can include article text, form labels, profile details, or other content present when saved.
Page URL
https://example.com/research/articleThe URL identifies the specific page being saved and can reveal browsing context tied to the reference.
04EvidencePLAIN NOTE
Observation

Observed during dynamic analysis: saving a reference caused the extension to request page content from the content script and send it as fullHTML to the backend endpoint.

Updated 30 September 2026knofkelobfihppebfpbcbnfeeifldfgf