Is LedgerPilot Vault Autofill safe?
LedgerPilot Vault Autofill looks up vault credentials from api.getledgerpilot.com and fills them into login forms on named vendor sites.
On login pages for vendors like Restaurant365, Square, Toast, Rippling, TouchBistro, and Auth0-backed portals, the extension sends the page URL and any visible username to its own backend to find a matching vault entry, then retrieves and types in the stored username, password, and one-time codes. A separate opt-in feature can, only when a user has explicitly captured a Dialpad SMS conversation and armed the feature, open a background tab to read a numeric MFA code from that conversation as a backstop when a vendor's own OTP delivery is pending.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed LedgerPilot Vault Autofill contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.getledgerpilot.com
LedgerPilot Vault Autofill sends data to api.getledgerpilot.com. No other extension we have analyzed sends data here.