Is Storybook WEB safe?

Low risk

Storybook WEB verifies stored JWTs over cleartext HTTP and reports signed-in users' active tab domains.

On browser startup, Storybook WEB reads the stored JWT and sends it as a bearer token to http://api.ssb.ee/api/krdx/storybookweb/verifyJwt. When a signed-in user's active tab changes, it posts the current domain to api.ssb.ee, and its page-detection feature can send page text-derived names, phone numbers, and domains to laiendus.ssb.ee for entity lookup.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Storybook OÜv1.5.7Chrome Web Store
15Risk
Who publishes it

Storybook OÜ - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Storybook OÜ
Declared legal entity
Storybook OÜ
Registered address
Tähe 129b, Tartu, Tartumaa 50113, Estonia
Registered contact
Marie Rosin

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.5.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on scorestorybook.ee

    https://scorestorybook.ee/

  • Read and change your data on ssb.ee

    https://ssb.ee/

  • Read and change your data on id.scorestorybook.ee

    https://id.scorestorybook.ee/*

  • Read and change your data on devid.scorestorybook.ee

    https://devid.scorestorybook.ee/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Add items to the right-click menu

    contextMenus

  • Sign you in with your Google account

    identity

Where it sends data

Destinations our analysis observed Storybook WEB contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.ssb.ee

    Storybook WEB sends data to api.ssb.ee. No other extension we have analyzed sends data here.

  • laiendus.ssb.ee

    Storybook WEB sends data to laiendus.ssb.ee. No other extension we have analyzed sends data here.

Updated 2 November 2026gepikfbdcmfjpbepamooklkocjliggaa