Is Titans Pro: Amazon KDP Keyword Tool - Quick View, Niche Finder, Search Vol safe?
Titans Pro sends Amazon and Etsy search data, page URLs, and cookies to go.selfpublishingtitans.com.
When used on Amazon, it posts searched text, search-result metrics, host details, and document cookies from the page to Self Publishing Titans APIs. On Etsy, it puts keyword, page URL-derived host data, language, and document cookies into a GET request to the same service, then uses a Self Publishing Titans WebSocket for suggestions.
Who publishes ithttps://selfpublishingtitans.com/ - 2 other listings from the same operator, 1 of them carrying a finding
https://selfpublishingtitans.com/ - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 110k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Etsy keyword tool puts cookies in a GET URL
When the Etsy keyword feature runs, the extension reads the entered keyword, Etsy hostname, browser language, and page cookies, then appends them to a GET URL for Self Publishing Titans, putting cookie data in the query string, not a body.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You use the Etsy keyword feature while an Etsy page is open.
The extension puts Etsy cookies, keyword input, hostname, and language into a Self Publishing Titans GET URL.
- Etsy page cookiesuaid=8c4f1e2b0a7d4c6e9f102938; user_prefs=currency=USD (illustrative)
These values can connect the request to your Etsy browsing session or site state.
- Keyword inputwedding planner printable
This shows the term you entered into the extension keyword tool.
- Etsy page hostnamewww.etsy.com
This identifies the Etsy page context where the feature ran.
- Browser languageen-US
This adds locale context to the keyword request.
The code expects JSON containing a token used to open the Etsy suggestion WebSocket.
Etsy script moves cookies into URL search parameters
Readable Etsy keyword flow
content-scripts/etsysearch.jsfunction buildEtsyKeywordRequest(token, payload) { const url = new URL(BASE_URL + "/api/v1/etsy/keywords"); Object.keys(payload).forEach((key) => url.searchParams.append(key, payload[key])); return { headers: { "Content-Type": "application/json", Authorization: "Bearer " + token, }, url: url.toString(), method: "GET", };}async function handleEtsySearch() { if (!keyword || keyword.length < 3 || keyword.length > 100 || isLoading || !userToken) return; setError(null); setRows([]); setSuggestions([]); setLoading(true); const payload = { keyword, hostname: hostnameFromUrl(window.location.href), language: window.navigator.language, cookies: document.cookie, }; const response = await sendMessage("handleApiRequests", buildEtsyKeywordRequest(userToken, payload)); if (response.data.token !== "") { const websocketToken = response.data.token; if (!websocketToken) { setLoading(false); setKeyword(""); setError("Error: Unable to get token"); return; } openEtsySuggestionSocket(websocketToken); startProgressTimer(); }}- go.selfpublishingtitans.com
Self Publishing Titans API host receiving the Etsy keyword query and serving the follow-up suggestion WebSocket.
Amazon keyword tooling transmits page cookies
When the Amazon keyword or quick-view features run, the extension sends current Amazon page cookies to Self Publishing Titans APIs, along with search text, marketplace context, page hostname, and search-result stats.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You use the Amazon keyword or quick-view tools while viewing Amazon search results.
The extension sends Amazon cookies together with search terms and page statistics to Self Publishing Titans.
- Amazon page cookiessession-id=123-4567890-1234567; ubid-main=135-2468135-9753146 (illustrative)
These values can connect the request to your Amazon browsing session or site state.
- Search textchildren activity book
This shows the keyword or product niche you entered into the extension tool.
- Amazon marketplacehostname=www.amazon.com; mid=ATVPDKIKX0DER
This identifies which Amazon site and marketplace the extension is reading.
- Page result contextsearch_result=50000; avg_bsr=18234; avg_reviews=146; avg_price=12.99
This describes the Amazon search results visible on the page when the tool runs.
The code expects a JSON response containing suggestion rows or table_list data.
Amazon scripts put document cookies into vendor API requests
Readable keyword suggestions flow
content-scripts/search.jsasync function runAmazonKeywordSearch() { if (!keyword) { alert("Please enter a keyword to search"); return; } if (!userToken) return; try { setLoading(true); setError(null); setRows([]); const request = { url: BASE_URL + "/api/v1/chrome/suggestions", method: "POST", body: { searchedText: keyword, language: getLanguage(), hostname: amazonHostname, mid: marketplaceId(amazonHostname), cookies: document.cookie, }, headers: { Authorization: "Bearer " + userToken }, }; let response; let usedFreeEndpoint = false; try { response = await sendMessage(HANDLE_API_REQUESTS, request); } catch { request.url = BASE_URL + "/api/v1/chrome/free-suggestions"; response = await sendMessage(HANDLE_API_REQUESTS, request); usedFreeEndpoint = true; } const rows = response.data.table_list || response.data; renderSuggestionRows(rows, usedFreeEndpoint); } catch (error) { setError("server error"); } finally { setLoading(false); }}Readable quick-view statistics flow
content-scripts/quick-view.jsconst buildBsrResultsRequest = (token, body, browserFingerprint) => ({ url: BASE_URL + "/api/v1/chrome/bsr-results", method: "POST", headers: { "Content-Type": "application/json", Authorization: "Bearer " + token, "X-Browser-Fingerprint": browserFingerprint, }, body,});async function sendAmazonSearchStats(products, token) { const priceStats = average(products, "price"); const reviewStats = average(products, "ratings"); const bsrStats = average(products, "bsr"); const searchBox = document.getElementById("twotabsearchtextbox"); const searchResultCount = readSearchResultCount(); const body = { search_text: searchBox?.value || "", search_result: searchResultCount, mid: marketplaceId(window.location.hostname), hostname: window.location.hostname, cookies: document.cookie, avg_bsr: bsrStats.avg, avg_reviews: reviewStats.avg, avg_price: priceStats.avg, }; const response = await sendBsrResults(token, body); updateSearchVolume(response.data.searchVolume); return response;}- go.selfpublishingtitans.com
Self Publishing Titans API host receiving Amazon keyword suggestions and quick-view search statistics.
Where it sends data
Destinations our analysis observed Titans Pro: Amazon KDP Keyword Tool - Quick View, Niche Finder, Search Vol contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- go.selfpublishingtitans.com
Titans Pro: Amazon KDP Keyword Tool - Quick View, Niche Finder, Search Vol sends data to go.selfpublishingtitans.com. One other extension we have analysed sends data here.