Is Siap Dips: Your Campus Companion safe?

Medium risk

Siap Dips sends Moodle quiz content to AI endpoints and can rewrite a Safe Exam Browser attestation header.

When its Ask AI feature is enabled on Moodle quiz pages, it reads question text and answer choices from the page and posts them to Gemini, an OpenAI-compatible endpoint, or a CLI proxy configured in the extension settings. The extension also imports Safe Exam Browser profiles and can add a dynamic browser rule that sets X-SafeExamBrowser-ConfigKeyHash for the configured exam URL.

myudakkv1.4.1057Chrome Web Store
45Risk
Who publishes it

myudakk - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
myudakk
Registered address
Jl. Prof. Soedarto No.13, Tembalang, Kec. Tembalang, Kota Semarang, Jawa Tengah 50275, ID
Registered contact
myudakk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sets Safe Exam Browser config hash header for exam URLs

After activating an exam profile, the extension configures Chrome rules that add a Safe Exam Browser config hash header to requests for the exam URL, carrying SEB attestation-style header data from ordinary Chrome, not the actual SEB app.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

The user activates an exam profile.

The extension did this

The extension installs a dynamic request rule that sets the X-SafeExamBrowser-ConfigKeyHash header for the configured exam URL.

Fields in the request
  • Safe Exam Browser config hash header
    X-SafeExamBrowser-ConfigKeyHash: a1b2c3d4e5f6... (illustrative)

    Carries exam configuration attestation context that a site may use to recognize a Safe Exam Browser session.

Where it sends data

Destinations our analysis observed Siap Dips: Your Campus Companion contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.openai.comwidely used

    Siap Dips: Your Campus Companion sends data to api.openai.com. A widely used service: 57 other extensions we have analysed send data here.

  • generativelanguage.googleapis.comwidely used

    Siap Dips: Your Campus Companion sends data to generativelanguage.googleapis.com. A widely used service: 31 other extensions we have analysed send data here.

Updated 30 September 2026inpmbpkngacgeljphlapgdgdjmoffild