Is Cashback Assistent von Shoop.de safe?

Cashback Assistent von Shoop.de injects a version meta tag into every page and sends analytics to Google via a hardcoded API secret.

The extension runs a content script on all URLs and inserts a <meta name='shoop-toolbar'> element readable by any in-page JavaScript. Its background script transmits analytics data to Google Analytics 4 via a Measurement Protocol API secret that is shipped in plaintext inside the extension bundle. These behaviors occur on every page the user visits while the extension is active.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.