Is NotebookLM Web Importer safe?
NotebookLM Web Importer is medium risk. After sign-in, NotebookLM Web Importer calls PostHog's identify API with your Clerk account ID, email, and username. Pre-login traffic was captured; the logged-in body wasn't, since sign-in wasn't finished, but the fields are in the source.
Who publishes itwong2 - 2 other listings from the same operator, 1 of them carrying a finding
wong2 - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 120k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Email and Username Sent to PostHog After Login
After sign-in, NotebookLM Web Importer calls PostHog's identify API with your Clerk account ID, email, and username.
Pre-login traffic was captured; the logged-in body wasn't, since sign-in wasn't finished, but the fields are in the source.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You sign in to the extension's account flow.
The extension links your signed-in account details to its PostHog analytics profile.
- Your account IDuser_2zJ8vF3n9bA6YkQpL4sRmT0uHc1 (illustrative)
Lets the analytics profile tie extension activity to the same signed-in account over time.
- Your email addressalex.rivera@example.com (illustrative)
Connects analytics activity to an address that can identify you directly.
- Your usernamealex-rivera (illustrative)
Adds another account handle that can connect analytics activity back to you.
Observed anonymous pre-login PostHog event relay; no email or username fields were populated.
The post-login identify call and PostHog destination are in the shipped bundle
Readable identify component
chunks/app-DOfluo0d.jsfunction iI() { const { user: e } = VC(); return p.useEffect(() => { e && !ut._isIdentified() && ut.identify(e.id, { email: e.primaryEmailAddress?.emailAddress, username: e.username }) }, [e]), null}Readable PostHog initialization
chunks/select-D8lnVALk.jsmM.init("phc_HTOgTAIl7exRb9KivpTPqn4gzIk9JKG8plYXEVl0D1", { api_host: "https://us.i.posthog.com", defaults: "2025-05-24", person_profiles: "always", autocapture: !1, capture_pageview: !1, capture_pageleave: !1, advanced_disable_decide: !0, disable_external_dependency_loading: !0});- us.i.posthog.com
PostHog analytics API host configured in the bundled client.
- notebooklm-web-importer.com
Observed relay host that received pre-login PostHog events during dynamic analysis.