Is RetailMeNot: Codes, Cash Back and Coupons safe?

RetailMeNot: Codes, Cash Back and Coupons transmits full page DOM content from shopping and checkout pages to api.onsleek.ai via the Sleek SDK.

On allowlisted shopping sites, the extension captures the full DOM of product, cart, and checkout pages — including the page URL, title, and user agent — and sends this data to api.onsleek.ai endpoints for page classification, cart extraction, and coupon automation. The extension applies PII redaction regexes before sending, but transmits the serialized DOM string regardless. Its injected content script (f.js) also accepts postMessage commands from any parent frame without validating the message origin, exposing DOM capture and form-input operations to cross-origin callers.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.