Is Promo Coders safe?

Medium risk

Promo Coders sends visited site domains and Google result domains to getutintsofthe.org for coupon lookups.

Promo Coders runs on all websites and sends the current top-level domain to getutintsofthe.org when it checks for coupons. On Google search pages, it also sends the domains from visible search results for coupon counts and can attach affiliate-click handling to results that return coupon URLs.

v1.0.4Chrome Web Store
45Risk
Who publishes it

No other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Website
promo-coders.com/contact.html

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Promo Coders sends every website you visit to a third-party coupon server

Promo Coders runs on every website, not just shopping sites, and sends the site's domain to getutintsofthe.org for coupon lookup.

This fires on page load, before you open the extension, even on non-shopping sites like example.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any website in your browser.

This includes ordinary, non-shopping sites; the content script runs everywhere the extension has permission, not only on merchant sites.

The extension did this

The extension extracts the site's domain and sends it to a third-party coupon server.

The background service worker requests getutintsofthe.org/get_coupon with the domain in the osr query parameter, before you open the extension or interact with the page.

Captured request
GEThttps://getutintsofthe.org/get_coupon?tid=1151557&auth=hdjshcfsljncs&geo=1&osr=example.com

200 OK, JSON body containing any coupon codes matching the requested domain, or an empty list if none exist.

Query parameters sent with every domain lookup
  • Visited domain
    amazon.com

    The top-level domain of the site you're currently on, extracted from the page URL.

  • Partner/tracking ID
    1151557

    A fixed identifier for this extension, sent with every lookup regardless of which site you're on.

  • API auth key
    hdjshcfsljncs

    A fixed key hardcoded in the extension that authenticates it to the coupon server; identical for every install.

  • Geo flag
    1

    Requests region-specific coupon results.

The code that does this

Content script triggers the lookup, background script sends it

Readable version

Content script initializes on every page — contentScripts/main.js:14–45

contentScripts/main.js
function getHostname() {  return extractTopDomain(window.location.hostname);}async function fetchConfig() {  if (currentSiteConfig) {    return currentSiteConfig;  }  const hostname = getHostname();  logMessage(`Fetching site configuration for hostname: ${hostname}`);  const config = await chrome.runtime.sendMessage({    type: MessageTypes.GET_SITE_CONFIG,    hostname  });  currentSiteConfig = config; // Cache the config  logMessage('Site configuration fetched and cached');  return config;}// Start the extensioninitialize();

Background service worker performs the lookup — bg/background.js:47–93

bg/background.js
async function fetchSiteConfig(hostname) {  logMessage(`Fetching site config for hostname: ${hostname}`);  const cached = configCache.get(hostname);  if (cached && (Date.now() - cached.timestamp < CACHE_DURATION)) {    if ((cached?.coupons?.coupons?.length ?? 0) > 0 || (cached?.coupons?.length ?? 0) > 0) {      chrome.storage.local.get('installData', (result) => {        if (result.installData) {          const url = new URL('https://pixel.getutintsofthe.org/extcoup?event=get_coupons&tid=1151557&name=promo_coders&merchant_domain=' + hostname);          Object.keys(result.installData).forEach(key => url.searchParams.append(key, result.installData[key]));          fetch(url.href, { method: 'POST', keepalive: true });        }      });    }    return cached.coupons;  }  try {    const response = await fetch(`${Config.apiUrl}/get_coupon?tid=1151557&auth=hdjshcfsljncs&geo=1&osr=${encodeURIComponent(hostname)}`);    if (!response.ok) throw new Error('API request failed');    const config = await response.json();    const coupons = config.coupons[0] || [];    if ((coupons?.coupons?.length ?? 0) > 0 || (coupons?.length ?? 0) > 0) {      chrome.storage.local.get('installData', (result) => {        if (result.installData) {          const url = new URL('https://pixel.getutintsofthe.org/extcoup?event=get_coupons&tid=1151557&name=promo_coders&merchant_domain=' + hostname);          Object.keys(result.installData).forEach(key => url.searchParams.append(key, result.installData[key]));          fetch(url.href, { method: 'POST', keepalive: true });        }      });    }    logMessage(`Fetched config for ${hostname}`);    // Cache the result    configCache.set(hostname, {      coupons,      timestamp: Date.now()    });    return coupons;  } catch (error) {    logMessage('Error fetching site config:', error);    return null;  }}
Third-party destinations
    • getutintsofthe.org

    Coupon lookup backend that receives the domain of every site you visit (via the osr parameter) and returns matching coupon codes.

Where it sends data

Destinations our analysis observed Promo Coders contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • getutintsofthe.org

    Promo Coders sends data to getutintsofthe.org. No other extension we have analysed sends data here.

  • pixel.getutintsofthe.org

    Promo Coders sends data to pixel.getutintsofthe.org. No other extension we have analysed sends data here.

Updated 30 September 2026ojaocmdncfmeiofoakhbjakapljmdgod