Is Jobalytics - Resume Keyword Analyzer safe?
Jobalytics - Resume Keyword Analyzer is medium risk. With persistent score on and a resume stored, visiting a job page on LinkedIn, Indeed, Workday, Glassdoor, or Handshake sends GA an event with the URL/title and a one-time device ID kept locally, tying your job visits together over time.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Job page URL and title sent to Google Analytics on every visit
With persistent score on and a resume stored, visiting a job page on LinkedIn, Indeed, Workday, Glassdoor, or Handshake sends GA an event with the URL/title and a one-time device ID kept locally, tying your job visits together over time.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a supported job posting or search page on LinkedIn, Indeed, Workday, Glassdoor, or Handshake with the persistent score feature on and a resume stored.
The feature is on by default; it can be turned off from the extension's settings.
The extension sends an event to Google Analytics containing the exact URL and title of the job page you're viewing.
The event is tagged with a device identifier the extension keeps in local storage so the events can be linked over time.
- Content-Type
- application/json
{ "client_id": "550e8400-e29b-41d4-a716-446655440000", "events": [ { "name": "persistent_score_displayed", "params": { "page_url": "https://www.linkedin.com/jobs/search?keywords=software%20engineer", "page_location": "https://www.linkedin.com/jobs/search?keywords=software%20engineer", "page_title": "1,000+ Software Engineer jobs in United States", "source": "linkedin_jobs_search", "extension_version": "6.6.0", "session_id": "1756500000", "engagement_time_msec": 10000 } } ]}- Exact page URLhttps://www.linkedin.com/jobs/search?keywords=software%20engineer (illustrative)
The full address of the job page you're viewing, including any search filters in the query string.
- Page title1,000+ Software Engineer jobs in United States
The browser tab title for the job page, often naming the search terms or the specific job posting.
- Persistent device identifier550e8400-e29b-41d4-a716-446655440000 (illustrative)
A random ID generated once and stored in your browser, letting Google Analytics link every job page you visit back to the same identifier.
Where the page URL and title are captured and sent
The score-display event, fired on every supported job page
js/createPersistentScore.jsvar scoreEl = document.getElementById("match_score");if (!scoreEl) { var vjsIframe = document.getElementById("vjs-container-iframe"); if (vjsIframe && vjsIframe.contentWindow) { try { scoreEl = vjsIframe.contentWindow.document.getElementById("match_score"); } catch (e) {} }}if (scoreEl && !scoreEl.dataset.displayReported) { scoreEl.dataset.displayReported = "1"; _getAnalytics().then(function(analytics) { analytics.trackEvent("persistent_score_displayed", { page_url: window.location.href, source: _getSource(), }); });}trackEvent() adds the page URL and title, then relays to the background service worker
js/analytics.jsasync function trackEvent(eventName, eventParams = {}) { // Sanitize event params const cleanParams = {}; for (const [key, value] of Object.entries(eventParams)) { if (value !== null && value !== undefined) { cleanParams[key] = String(value).substring(0, 100); } } // Add page_location so GA4 can determine user geography and page attribution try { if (typeof window !== "undefined" && window.location) { cleanParams.page_location = window.location.href.substring(0, 1000); cleanParams.page_title = (document.title || window.location.pathname).substring(0, 300); } } catch (e) {} const sanitizedName = eventName.substring(0, 40); // If we're in a content script, relay to background service worker if (_isContentScript()) { try { chrome.runtime.sendMessage({ action: "analytics_event", eventName: sanitizedName, eventParams: cleanParams, }); } catch (err) { console.error("[Jobalytics Analytics] Relay error:", err); } return; } // Otherwise, send directly (extension pages & service worker) await _sendEvent(sanitizedName, cleanParams);}_sendEvent() builds the request and posts it to Google Analytics
js/analytics.jsasync function _sendEvent(eventName, cleanParams) { const clientId = await getClientId(); const aiRollout = await _resolveAiRollout(); const extVersion = _getExtensionVersion(); if (extVersion) { cleanParams.extension_version = extVersion; } const payload = { client_id: clientId, events: [ { name: eventName, params: { ...cleanParams, session_id: _getSessionId(), engagement_time_msec: 10000, }, }, ], }; if (aiRollout) { payload.user_properties = { ai_rollout: { value: aiRollout }, }; } const endpoint = DEBUG_MODE ? GA_DEBUG_ENDPOINT : GA_ENDPOINT; const url = `${endpoint}?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`; try { const response = await fetch(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload), keepalive: true, }); } catch (err) { console.error("[Jobalytics Analytics] Fetch error:", err); }}- www.google-analytics.com
Google's Measurement Protocol (GA4) endpoint. Receives the job page URL, title, and a persistent client ID per display event. Operated by Google LLC.