Is Shielded safe?
Shielded sends full email content to its own backend and OpenAI, protected only by a bearer token shared by every install worldwide.
Shielded scans Gmail and Roundcube inboxes, sending the subject, sender, body text, and base64-encoded attachments to the developer's backend and to OpenAI for phishing analysis, enabled by default with no opt-in prompt. Every request to that backend is authenticated with a single hardcoded bearer token identical across all installs, with only a client-supplied, easily guessable user ID distinguishing one user's history from another's. The extension also writes that user ID into the Gmail page DOM as a hidden input, where any other script on the page can read it.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Shielded contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.openai.comwidely used
Shielded sends data to api.openai.com. A widely used service: 76 other extensions we have analyzed send data here.
- chrome.server.resaka.my.id
Shielded sends data to chrome.server.resaka.my.id. No other extension we have analyzed sends data here.