Is Season Pass Pass safe?

Season Pass Pass intercepts Bungie API keys from network headers and redirects Settings API calls to a third-party Cloudflare Worker.

The extension monitors outgoing requests to bungie.net and captures the X-API-Key header, storing it in local extension storage. It then broadcasts this key into the bungie.net page context via window.postMessage, where any script on that page can read it. When a season override is active, the extension also redirects the user's Bungie Settings API requests to destiny-activities.destinyreport.workers.dev, a third-party Cloudflare Worker, passing a season parameter in the URL.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.