Is Picodi.com Cashback safe?
Picodi is medium risk. Picodi.com Cashback sends Picometric telemetry on coupon-assist events: page URL in uri_str, event details in data, install ID in iid. An earlier traffic run missed this beacon since auto-apply needed a logged-in checkout with cart items.…
Who publishes itPicodi.com SA - no other listings under this identity, 4 shared hostnames
Picodi.com SA - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Picodi sends coupon-page URLs to Picometric
Picodi.com Cashback sends Picometric telemetry on coupon-assist events: page URL in uri_str, event details in data, install ID in iid.
An earlier traffic run missed this beacon since auto-apply needed a logged-in checkout with cart items.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You start or view Picodi's coupon auto-apply flow on a shopping page.
The extension sends Picometric telemetry that includes the page address and a persistent installation ID.
- Current page URLhttps://www.asos.com/checkout (illustrative)
Shows the shopping or checkout page active when coupon assistance runs.
- Coupon event labelCAA_START
Shows which coupon-assist step happened, such as starting, showing, succeeding, or failing.
- Coupon event data{"shopUrlName":"asos","numberOfCoupons":3} (illustrative)
Adds shop-specific coupon context to the page event.
- Installation ID847362915
Lets the telemetry provider connect coupon events from the same browser installation over time.
No live response captured in the traffic pass; endpoint and method come from the shipped code path.
- Content-Type
- application/json
Coupon events forward the current page to Picometric
CAA start event with page URL
content.jse.prototype.onTestButtonClick = function() { this.$emit("toggle-popup"), this.$emit("set-modal-type", "PROGRESS"), this.couponApplier.caaStart(), this.couponApplier.caaAnalyticsHelper.sendAnalytics("START"), this.couponApplier.picometricHelper.pushEvent(this.locale, "CAA_START", JSON.stringify({ shopUrlName: this.shopUrlName, numberOfCoupons: this.numberOfCoupons }), window.location.href), this.sendGaEvent(), this.createRedirectPinTab()}Picometric helper forwards the URL field
content.jsconst ci = new(function() { function t() {} return t.prototype.pushEvent = function(t, e, i, n) { M.send((function(r) { r.setType(tt.PICOMETRIC_PUSH_EVENT).setAsync(!0).setValue("locale", t).setValue("event", "c").setValue("label", e).setValue("data", i).setValue("uri_str", n) })) }, t}());Background sender builds the Picometric GET request
background.jsconst Yt = function() { function t(t) { this.installationId = t } return t.prototype.getUrl = function() { return "".concat("https://metric.picodi.com/").concat(this.locale, "/t") }, t.prototype.getHeader = function() { return { "Content-Type": "application/json" } }, t.prototype.setLocale = function(t) { this.locale = t }, t.prototype.send = function(t, e, r, o) { return $t(this, void 0, Promise, (function() { var i, a = this; return qt(this, (function(u) { return i = this.getUrl(), [2, new Promise((function(u, s) { var c = new n; fetch(i + "?" + new URLSearchParams({ event: t, label: e, data: r, uri_str: o, iid: a.installationId.toString() }), { method: "GET", headers: a.getHeader() }).then((function(t) { c.setResponse(t), u(c) })).catch((function(t) { c.setError(t), s(c) })) }))] })) })) }, t}();- metric.picodi.com
Picodi Picometric telemetry endpoint receiving coupon event label, event data, current page URL, and installation ID.
Install Beacon Transmits Browser Fingerprint to Picodi API
The first Picodi Cashback run after install sends a beacon with your user-agent, platform, language, install date, and a random persistent ID.
It fires once, can't be disabled; user-agent and platform act as fingerprint signals.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install the extension for the first time.
The extension immediately registers with Picodi's API, transmitting your browser's user-agent, platform, and language alongside a freshly minted persistent device ID.
This registration is unconditional and automatic. There is no opt-out. The beacon fires before you visit any shopping site.
- Installation IDe3fda999f0193
A randomly generated 13-character string stored permanently. All future requests to Picodi's API use this value to identify your device.
- Token93a2532c03834
A second 13-character random string generated at the same time as the installation ID, sent alongside it.
- User-agent stringMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Your browser's full user-agent, revealing OS version, browser version, and device type.
- PlatformMacIntel
The OS platform reported by the browser (e.g. MacIntel, Win32, Linux x86_64).
- Browser UI languageen-GB
The language your browser is set to, identifying your configured locale.
- Installation date2026-06-05 23:54:00
The exact date and time the extension was first run.
- Affiliate subsid (optional)af123456
If an affiliate tracking cookie is present, its value is appended as userId, linking your install to an ad-network referral.
- api-ec1.picodi.com
Picodi's primary API endpoint. Receives the install beacon with device fingerprint fields and registers the installationId against the device profile.
GA4 Telemetry Reports Popup Interactions and Shop Names
Each time Picodi Cashback's popup opens on a shopping site, it sends the page URL, shop name, and a persistent device identifier to Google Analytics automatically, letting Google link your activity across sessions.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You visit a shopping site and the Picodi popup appears, or you open or close it.
The extension sends your page URL, the shop name, and a persistent device ID to Google Analytics automatically.
This fires on every popup open, close, and page load on an activated shop page. No user interaction with the popup is required for the page_view event.
- Content-Type
- application/x-www-form-urlencoded
{ "client_id": "e3fda999f0193", "events": [ { "name": "page_view", "params": { "country_prefix": "uk", "page_title": "cashback_prompt", "page_location": "/uk/cb/asos/notify", "shop_url_name": "asos", "test_variant": "B" } } ]}- Device identifier (client_id)e3fda999f0193
A 13-character ID generated at install and stored permanently. Links all your activity on every shopping site to the same profile at Google.
- Shop name (shop_url_name)asos
The name of the retail site you are visiting, e.g. 'asos' or 'amazon.com'.
- Page URL (shop_url_name on open/close)[asos] - https://www.asos.com/women/dresses/
On popup open and close events, the full current page URL is appended to the shop_url_name field.
- Locale / region (country_prefix)uk
Your browser's configured locale, identifying your country.
- Session ID1717632000000
A timestamp-based session identifier, rotated every 30 minutes.
- www.google-analytics.com
Google Analytics 4, receives popup interaction events, shop names, page URLs, and the persistent device identifier.
What it can do
Permissions this extension asks for, as declared in version 7.5.12. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 7.5.13, which we have not unpacked yet.
Read and change your data on every site you visit
*://*/*
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Read and change cookies, including the ones that keep you signed in
cookies
Watch every request your browser makes
webRequest