Is Rocket Sender safe?

Medium risk

Rocket Sender is medium risk. Enabling AI Reply and clicking reply-suggestion makes the extension read recent WhatsApp messages, package the time, sender role, and text, and post that array from the service worker to ai.rocketsend.io/reply for suggested replies.

William A. v4.43.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

WhatsApp chats sent for AI reply suggestions

Enabling AI Reply and clicking reply-suggestion makes the extension read recent WhatsApp messages, package the time, sender role, and text, and post that array from the service worker to ai.rocketsend.io/reply for suggested replies.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click the AI reply control inside WhatsApp Web after enabling the feature.

The extension did this

The extension reads recent messages from the open chat and sends them to Rocket Sender's AI reply service.

02EvidenceFIELD TABLE
Conversation fields prepared for the reply request
FieldValueWhy it matters
Recent message text
Can I get back to you soon? (illustrative)Shares words from the open chat so the remote service can draft suggested replies.
Message time
10:42 AM (illustrative)Adds timing context from the WhatsApp message header next to the message text.
Sender role
YouMarks whether each message appears to come from you or from the other chat participant.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://ai.rocketsend.io/reply
Headers
Content-Typeapplication/json
04EvidenceCODE COMPARE
The code that does this

Content script gathers WhatsApp messages; service worker posts them

What it actually does
Readable content bundle: collect recent WhatsApp messagesdist/content.bundle.js
jt = function() {
  var e = Array.from(document.querySelectorAll("#main .copyable-area .copyable-text[data-pre-plain-text]")),
    t = [],
    n = new Set,
    o = new Set;
  return e.slice(-8).forEach((function(e) {
    var i, r = e.closest(".focusable-list-item"),
      a = null == r ? void 0 : r.classList.contains("message-out"),
      s = e.getAttribute("data-pre-plain-text"),
      c = null === (i = e.querySelector(".selectable-text")) || void 0 === i ? void 0 : i.textContent.substring(0, 100);
    if (s && c) {
      var l = s.match(/\[(.*?)\] (.*?):/);
      if (l) {
        var d = T(l, 3),
          u = d[1],
          p = d[2];
        a ? n.add(p.trim()) : o.add(p.trim()), t.push({
          time: u,
          sender: a ? "You" : "Them",
          message: c
        })
      }
    }
  })), {
    conversation: t,
    sender: Array.from(n),
    receiver: Array.from(o)
  }
}
Readable content bundle: send conversation to the service workerdist/content.bundle.js
Ht = function() {
  var e = t(c().mark((function e() {
    var t, n, o;
    return c().wrap((function(e) {
      for (;;) switch (e.prev = e.next) {
        case 0:
          return e.prev = 0, Ft(), t = jt(), n = t.conversation, e.next = 5, chrome.runtime.sendMessage({
            type: "getAIReplySuggestions",
            conversation: n
          });
        case 5:
          (o = e.sent).success && o.messages.forEach((function(e, t) {
            var n = Nt(e, !0),
              o = n.style.backgroundColor;
            n.style.backgroundColor = "#81c784", setTimeout((function() {
              n.style.backgroundColor = o
            }), 1e3), Dt(n)
          })), e.next = 12;
          break;
        case 9:
          e.prev = 9, e.t0 = e.catch(0), console.error("Error sending message to service worker:", e.t0);
        case 12:
          return e.prev = 12, Pt(), e.finish(12);
        case 15:
        case "end":
          return e.stop()
      }
    }), e, null, [
      [0, 9, 12, 15]
    ])
  })));
  return function() {
    return e.apply(this, arguments)
  }
}()
Readable service worker: receive the message and POST the payloadmain-service-worker.js
chrome.runtime.onMessage.addListener((msg, sender, response) => {
  if (msg.name === "validateLicense") {
    validateLicense(msg.params)
      .then((res) => {
        response({ success: true, message: "License key activated.", data: res });
      })
      .catch((err) => {
        response({ success: false, message: "An error occurred. Please contact customer service." });
      });
  }

  if (msg.type === 'getAIReplySuggestions') {
    fetchAIReplySuggestions(msg.conversation)
      .then(messages => response({ success: true, messages }))
      .catch(error => response({ success: false, error: error.message }));
    return true;
  }

  return true;
});

async function fetchAIReplySuggestions(conversation) {
  try {
    const response = await fetch(`https://ai.rocketsend.io/reply`, {
      method: 'POST',
      headers: {
          'Content-Type': 'application/json'
      },
      body: JSON.stringify({conversation})
  });


    if (!response.ok) {
      const error = await response.json();
      throw new Error(`OpenAI API Error: ${error.error?.message || 'Unknown error'}`);
    }

    const data = await response.json();
    return data.messages;
  } catch (error) {
    console.error('Error in fetchAIReplySuggestions:', error);
    throw error;
  }
}
05EvidenceTHIRD PARTY LIST
Remote host receiving the reply-suggestion request
  • ai.rocketsend.io

    Receives the conversation array and returns AI-generated reply suggestions for Rocket Sender.

Updated 17 September 2026ihbbifgcppfejeobcljahinddoplnohi