Is Robô de Comentários - Bot de Sorteios safe?

Medium risk

Robô de Comentários - Bot de Sorteios sends Instagram profile details, location, and device data to botsorteios.com.

When running on Instagram, the extension loads settings from botsorteios.com and, after login, reads Instagram account profile fields such as email, phone number, birthday, gender, username, and full name. If remote settings enable it, it also requests precise geolocation and combines it with device fingerprint details before posting the bundle back to botsorteios.com while the app is active.

MGDEVv2.1.5Chrome Web Store
45Risk
Who publishes it

MGDEV - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
MGDEV
Website
botsorteios.com/suporte/

Same store account

1 other listing published from this account, 3k+ users between them, none of them carrying a finding.

Followers & Unfollowers - Follower Manager3k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Hardcoded Instagram bearer token used for vote-pool requests

Using the extension's vote-pool helper on Instagram sends POST requests to Instagram API endpoints carrying a hardcoded bearer credential stored in the extension code, not a token from your current session.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You use the vote-pool registration control.

The extension did this

The extension sends Instagram API requests with a hardcoded bearer credential.

Captured request
POSThttps://i.instagram.com/api/v1/news/inbox_seen/ and https://i.instagram.com/api/v1/media/<media>/<poll>/story_poll_vote/
Fields in the request
  • Instagram bearer credential
    Bearer IGT:2:<redacted>

    Authorizes the Instagram API calls and can act as an account access credential.

Observation

Dynamic analysis confirmed that the vote-pool path posts to Instagram inbox_seen and story_poll_vote endpoints with a hardcoded bearer authorization header.

Where it sends data

Destinations our analysis observed Robô de Comentários - Bot de Sorteios contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • botsorteios.com

    Robô de Comentários - Bot de Sorteios sends data to botsorteios.com. No other extension we have analysed sends data here.

Updated 30 September 2026bjnpegkfapgbhbigafiadmhajobdhahh