Is Ripple Tools safe?

Question

Accepted Answer

Ripple Tools is medium risk. When you search for a mental-health crisis term on Google, YouTube, Bing, DuckDuckGo, Yahoo, Ecosia, or Ask, the Ripple Tool extension captures the exact text you typed and transmits it to Mixpanel, a third-party analytics service operated by Twilio. Dynamic analysis confirmed this: a search for a crisis phrase was observed in a POST request to api-js.mixpanel.com containing the raw search term alongside a session identifier stored in your browser's localStorage. The extension sends the verbatim query text — not just a hash — to Mixpanel's servers. This occurs automatically on every keyword match, whether or not you interact with the help overlay the extension displays. When you search for a crisis-related term, the Ripple Tool extension fetches a full HTML document from cms.ripplesuicideprevention.com and inserts it into the search engine page via innerHTML, with no cryptographic integrity verification on the received content. Dynamic analysis confirmed this: a GET request to the CMS server returned a JSON body whose 'html' field contained a complete HTML document, which was subsequently rendered in a shadow DOM overlay on the Google search results page. Because no hash, signature, or Content Security Policy is applied to the fetched HTML before insertion, the content displayed to users is determined entirely by whatever the CMS server returns at the time of the request. A compromise of that server would allow modified HTML to be delivered to all users' search pages on the seven supported engines.

Is Ripple Tool safe?

Findings