Is Rakuten: Get Cash Back For Shopping safe?

// Check feature flag (OCPDOM_CAPTURE_EABLED — note: typo in source)
const captureEnabled = featureFlags.isEnabled(FLAGS.OCPDOM_CAPTURE_EABLED);

// Fire only when: page is an order confirmation, capture not yet done,
// and an active Rakuten shopping trip tracking number exists
if (pageType === 'OrderConfirm' && captureEnabled &&
    !this.OCPDOMCaptured && this.merchant.session.shoppingTrip.ttn) {

  // Capture the ENTIRE page HTML
  const html = document.documentElement.innerHTML;

  if (html) {
    // Fire event to background service worker
    sendEvent('OCPDOMCapture', {
      content: html,          // full page HTML
      merchant: this.merchant,
      detail: pageType
    });
    this.OCPDOMCaptured = true;  // prevent duplicate sends
  }
}

// Upload #1: POST to Rakuten analytics backend (ecbsn.com)
handleCaptureOrderPage({ url, tabId, data }) {
  const { storeName, storeId, session } = data.merchant;
  this.postData(this.deps.captureOrderUrl, {}, {
    tenant_id: this.deps.tenantId,
    source_name: 'toolbar',
    store_name: storeName,
    store_id: storeId,
    shopping_trip_id: session.shoppingTrip.ttn,
    rr_member_id: this.deps.getMemberId(),  // Rakuten account ID
    content_source: url,                    // order confirmation URL
    content_type: 'order confirmation',
    content_format: 'html',
    content: data.content                   // full page HTML
  });
}

// Upload #2: POST to Fillr third-party capture (fillr-tech.com)
handleOCPDOMCapture({ url, tabId, data }) {
  const ebToken = this.deps.getEBToken();
  if (this.deps.fillrOCPDOMUploadUrl && ebToken) {
    const headers = {
      'x-dev-key': this.deps.domUploadDevKey,  // hardcoded: f401eb0b18d9ca5c20ad6e16574b0e27
      ebtoken: ebToken
    };
    this.postData(this.deps.fillrOCPDOMUploadUrl, headers, {
      tracking_ticket: session.shoppingTrip.ttn,
      content: data.content  // same full page HTML
    });
  }
}

// Both uploads use gzip compression
async postData(url, extraHeaders = {}, payload) {
  const compressed = await gzip(JSON.stringify(payload));
  return await fetch(url, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Content-Encoding': 'gzip',
      ...extraHeaders
    },
    body: compressed
  });
}

// Fires on every handleDocumentComplete (navigation) event.
async function trackNonPartnerPage(url) {
  const domain = parseDomain(url)?.domain;
  if (!domain) return;
  if (!settings.get('trackNP')) return;  // feature flag must be enabled
  if (!self.EBATES) return;

  // Lazy-load tracked domain list from remote config
  if (!domainSet) domainSet = await DomainList.getDomains();
  if (!domainSet.has(domain)) return;

  // Dedup: skip if already sent within the last 30 minutes
  if (!lastVisitMap) lastVisitMap = await storage.get('np-domains-last-visit') || new Map();
  lastVisitMap.forEach((ts, d) => {
    if (ts + 1_800_000 < Date.now()) lastVisitMap.delete(d);  // expire old entries
  });

  if (!lastVisitMap.has(domain)) {
    // Send to Segment analytics
    EBATES.segment.track('Visit NP Page', { host: domain });

    // Send to Rakuten holistic messaging
    const fullUrl = `https://${domain}`;
    EBATES.holistic.track(Events.WebsiteVisited, {
      data: { website_visit_id: generateUUID() },
      url: fullUrl
    });
  }

  lastVisitMap.set(domain, Date.now());
  await storage.set('np-domains-last-visit', lastVisitMap);
}

// The Segment analytics client, configured with a hardcoded write key.
const segmentClient = new SegmentAnalytics({
  key: config.get('SEGMENT_KEY'),    // 'RRkzrctEwtmgt8PgYWkF6SzN62oaAiID'
  host: config.get('SEGMENT_HOST'),  // 'https://events.engager.ecbsn.com'
});

// The POST that transmits queued events:
fetch(`${this.host}/v1/batch`, {
  method: 'POST',
  headers: {
    Authorization: `Basic ${btoa(this.writeKey + ':')}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(batch),
});

// Called with a reason of 'timed out', 'closed tab', 'reload tab',
// 'forward_back', or 'page error' whenever an affiliate redirect
// doesn't complete cleanly.
function handleActivationFailure({ tabId, reason, extra }) {
  const tab = pendingActivations.get(tabId);
  if (!tab) return;

  const storeId = tab.storeId;
  const merchant = self.EBATES.merchants.get(storeId);
  const trip = merchant?.session.shoppingTrip.getCurrentState();

  const payload = {
    store_id: storeId,
    redirect_chain: tab.urls.toString(),   // every URL in the redirect hop
    reason,
    ...extra,
    ...(trip ? {
      activation_type: trip.type,
      attribution_source_previous_click: trip.source,
      tracking_ticket: trip.ttn,
    } : {}),
  };

  // Sent to Rakuten's own Segment pipeline...
  self.EBATES.segment.track('Activation Failure', payload);
  // ...AND to the third-party Datadog logger, same payload.
  ddLogger.warn('ActivationStatus', payload);

  self.EBATES.settings.affiliates.clear(tabId);
}

class DdLogger {
  globalContext = {};
  batch = [];

  warn(message, fields = {}) {
    return this.addToBatch(message, fields, 'warn');
  }

  async addToBatch(message, fields, status) {
    if (this.disabled) return;
    const entry = {
      ...fields,
      ...this.globalContext,
      ddsource: 'browser',
      message,
      date: Date.now(),
      http: { useragent: navigator.userAgent },   // added to EVERY log entry
      status,
      origin: 'logger',
      view: {
        referrer: `${self.location.origin}/`,     // the extension's own page URL
        url: `${self.location.origin}/`,
      },
    };
    // ddIgnoreList can suppress specific messages; ActivationStatus is not on it
    this.batch.push(entry);
    await this.fetching;
    this.send();
  }

  fetch(batch) {
    return fetch(
      buildUrl('https://browser-intake-datadoghq.com/api/v2/logs', {
        ddsource: 'browser',
        ddtags: 'api:fetch,datacenter:us',
        'dd-api-key': config.get('DATADOG_TOKEN'),  // hardcoded, same for every install
        'dd-evp-origin': 'browser',
        'dd-request-id': generateRequestId(),
      }),
      { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(batch) }
    );
  }
}