Is TopCashback UK Get Cashback & Vouchers safe?
TopCashback is medium risk. Code analysis shows the bundled Sleek SDK can upload a compressed copy of the page HTML, URL, title and user agent to api.onsleek.ai on allowlisted sites, when a remote flag is on.
Who publishes itTopCashback Limited - no other listings under this identity, 7 shared hostnames
TopCashback Limited - no other listings under this identity, 7 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 7 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Sleek SDK sends full page HTML and URL to api.onsleek.ai on allowlisted sites
Code analysis shows the bundled Sleek SDK can upload a compressed copy of the page HTML, URL, title and user agent to api.onsleek.ai on allowlisted sites, when a remote flag is on.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You load a page on a site the Sleek allowlist enables.
The SDK serializes the page and POSTs it, with URL, title and user agent, to api.onsleek.ai.
Further endpoints receive the same page string for classification and order extraction.
DOM capture and support-check upload in mf.js
Request helper: bearer key, gzip body, api.onsleek.ai base
mf.jsasync apiRequest(a, e, o, t, i, s = !1, n = !1, r = 3, l = 1e3) { const c = (() => { const a = (this.sdkOptionsService.getOptions().envOverride ?? {}).API_ENDPOINT; return a ? a.replace(/\/$/, "") : "https://api.onsleek.ai" })(), u = new G.URL(`${c}${a}`); const m = {Authorization: `Bearer ${this.apiKey}`, "x-sleek-sdk-version": Z}; s && (m["Content-Encoding"] = "gzip"), t && (m["Content-Type"] = "application/json"); /* body: TextEncoder -> CompressionStream("gzip") when s is true */}- domString<html lang="en"><head>...</head><body>...</body></html>
The serialized HTML of the whole page, including text you can see on it.
- urlStringhttps://www.example-shop.com/checkout?cart=88213
The full address of the page, which can carry account or order identifiers.
- titleCheckout | Example Shop
The page title shown in your tab.
- userAgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36
Your browser and operating system string.
- api.onsleek.ai
Sleek SDK vendor API: support-check, coupon-agent, page-classifications, order and product extractions.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.