Is Rakuten Button Canada safe?

Medium risk

Rakuten Button Canada uploads the full HTML of order confirmation pages to capture.ecbsn.com after shopping trips.

On pages detected as order confirmations during an active cashback shopping trip, the extension reads the page's full HTML and sends it, gzipped with the store and trip details, to capture.ecbsn.com. This logging setting is on by default and can be turned off by the user.

v7.15.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Rakuten Button uploads full order confirmation page HTML to capture.ecbsn.com

Code analysis shows the extension sends the complete HTML of your order confirmation page to capture.ecbsn.com after a cashback trip.

It is on by default and can be switched off in settings.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You activate cashback and complete checkout on a supported store.

The extension did this

The extension uploads the whole order confirmation page HTML to capture.ecbsn.com.

The code that does this

Content script reads the page and fires the capture event

Readable version
content/bundle.js
n.A.extension.fireEvent("CaptureOrderPage", {  data: {    content: r,    load_time: a.default.now() - i,    javascript_error: !!e.length,    merchant: t  }})
The code that does this

Background handler packages and posts the HTML

Readable version
bg/bundle.js
CAPTURE_ORDER: "https://capture.ecbsn.com/api/1.0/commercecapture"
Fields in the uploaded record
  • Page content
    <html>...order #114-2231 ...</html> (illustrative)

    The full HTML of the order confirmation page, which can include order details.

  • Page address
    https://www.example-store.ca/checkout/confirmation

    The URL of the order page you were on.

  • Store and trip IDs
    store_id 10226, shopping_trip_id set

    Which store and cashback trip the order belongs to.

  • Client info
    chrome, 7.15.0

    Browser name and extension version.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Rakuten contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • capture.ecbsn.com

    Rakuten sends data to capture.ecbsn.com. 5 other extensions we have analysed send data here.

Updated 15 October 2026idpbkophnbfijcnlffdmmppgnncgappc