Is +rep ID safe?
+rep ID lets anyone forge a "cryptographically signed" reputation tag on its public backend without checking any signature.
The extension markets tags as ZK-verified, signature-backed attestations, but its background script forwards the signature and author address to Supabase without ever verifying that the signature recovers to the claimed address, and the Supabase database's own row-level security allows unauthenticated inserts on the tags and users tables. Because the extension's public API key is hardcoded in its config and sent on every request, anyone can post directly to the backend with a fabricated author address and signature, and the extension's UI will display it as a normal verified tag.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed +rep ID contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- euattpparszwowwkwesg.supabase.co
+rep ID sends data to euattpparszwowwkwesg.supabase.co. No other extension we have analyzed sends data here.