Is leetcode cheatsheet safe?
leetcode cheatsheet sends problem page HTML, URL, title, language, and editor code to RapidAPI when you click write solution.
When you use the write-solution button on LeetCode pages, the extension reads the current problem description HTML, page title, URL, selected language, and editor contents. It posts that data to my-store2.p.rapidapi.com for storage and ships the RapidAPI key used for those requests in the extension bundle.
Who publishes itazl397985856 - no other listings under this identity
azl397985856 - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
LeetCode helper sends problem page and editor code after button click.
When you click the write-solution button on a LeetCode page, the extension collects the page HTML, page URL, page title, selected language, and editor code.
It sends those fields by POST to my-store2.p.rapidapi.com/order/new.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You click the write-solution button on a LeetCode problem page.
The extension collects the problem page HTML, URL, title, language, and editor code, then posts them to my-store2.p.rapidapi.com/order/new.
- Problem page HTML<div data-track-load="description_content">Two Sum...</div> (illustrative)
The page content can include the full problem statement and surrounding page data.
- Editor codefunction twoSum(nums, target) { return []; } (illustrative)
The code field contains what you typed into the LeetCode editor.
- Page URLhttps://leetcode.com/problems/two-sum/ (illustrative)
The URL identifies the exact LeetCode problem page you were viewing.
- Page titleTwo Sum - LeetCode (illustrative)
The title names the problem or page context associated with the submitted code.
What it can do
Permissions this extension asks for, as declared in version 0.12.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed leetcode cheatsheet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- my-store2.p.rapidapi.com
leetcode cheatsheet sends data to my-store2.p.rapidapi.com. No other extension we have analysed sends data here.