Is Season Pass Pass safe?
Season Pass Pass intercepts Bungie API keys from network headers and redirects Settings API calls to a third-party Cloudflare Worker.
The extension monitors outgoing requests to bungie.net and captures the X-API-Key header, storing it in local extension storage. It then broadcasts this key into the bungie.net page context via window.postMessage, where any script on that page can read it. When a season override is active, the extension also redirects the user's Bungie Settings API requests to destiny-activities.destinyreport.workers.dev, a third-party Cloudflare Worker, passing a season parameter in the URL.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on bungie.net
*://*.bungie.net/*
Store data in your browser
storage
Watch every request your browser makes
webRequest
Watch, block and rewrite every request your browser makes
webRequestBlocking
Where it sends data
Destinations our analysis observed Season Pass Pass contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- destiny-activities.destinyreport.workers.dev
Season Pass Pass sends data to destiny-activities.destinyreport.workers.dev. No other extension we have analyzed sends data here.