Is Moon: Shop online with Bitcoin safe?

Medium risk

Moon is medium risk. When you use Moon signed in, the extension sends account details, including email, display name, and Cognito user-sub, to Mixpanel at api.mixpanel.com. Later analytics events attach to that identified profile.

paywithmoon.comv3.2.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Account profile data is sent to Mixpanel analytics.

When you use Moon signed in, the extension sends account details, including email, display name, and Cognito user-sub, to Mixpanel at api.mixpanel.com.

Later analytics events attach to that identified profile.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user performs an action while signed in to Moon.

The extension did this

The extension sends the logged-in account email, name, and Cognito user-sub to Mixpanel analytics.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.mixpanel.com
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Extension storage account data
user@example.com (illustrative)Stored sign-in profile data can identify the Moon account being used.
Tab context
active shopping tab (illustrative)Tab-related analytics context can connect extension activity to browsing state.
04EvidencePLAIN NOTE
Observation

Dynamic analysis confirmed the Mixpanel path that resolves the signed-in account profile, identifies the Cognito user-sub, and sets profile fields before posting to api.mixpanel.com.

Updated 17 September 2026ehmpejjklcibliopgbghpgfinhbjopnn