Is RiteTag safe?

Medium risk

RiteTag is medium risk. When you ask RiteTag for hashtag suggestions, the extension includes the current page domain in the request to RiteKit's API. That means the service receives which site you were on when the suggestion request was made.…

RiteKitv2.5.1Chrome Web Store
45Risk
Who publishes it

Maintop Businesses s.r.o. - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RiteKit
Declared legal entity
Maintop Businesses s.r.o.
Registered address
848 Radějovská, Strážnice 696 62, CZ
Registered contact
Michal Hudeček

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

longdomainname.com
Also called by 6 other listings, including Old Twitter Layout, TubeBuddy, Old Twitter Layout (2026)

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

RiteTag sends the page domain with hashtag suggestion requests.

When you ask RiteTag for hashtag suggestions, the extension includes the current page domain in the request to RiteKit's API.

That means the service receives which site you were on when the suggestion request was made.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user requests hashtag suggestions in RiteTag.

The extension did this

The extension sends the current page domain to RiteKit's hashtag suggestion API.

02EvidenceNETWORK CAPTURE
Captured request
POSTapi.ritekit.com/v2/stats/hashtag-suggestions
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Current page domain
example.com (illustrative)Shows which website was open when the user requested hashtag suggestions.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

RiteTag sends selected text and page domain for hashtag suggestions

Selecting text and using RiteTag's context-menu action sends that page text and the current page domain to RiteKit's hashtag API at api.ritekit.com, which returns hashtag suggestions for the content.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user selects text and uses the RiteTag context-menu action.

The extension did this

The extension sends the selected text and current page domain to RiteKit for hashtag suggestions.

02EvidenceNETWORK CAPTURE
Captured request
POSTapi.ritekit.com/v2/stats/hashtag-suggestions
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Selected page text
Product launch announcement text (illustrative)This is page content you highlighted before asking RiteTag for hashtag suggestions.
Current page domain
example.com (illustrative)This identifies the website where the selected text came from.

What it can do

Permissions this extension asks for, as declared in version 2.5.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on ritetag.com

    https://ritetag.com/*

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

  • Show you desktop notifications

    notifications

Updated 30 September 2026hclhpnhohpmlbadmeieecaandnglfodm