Is TopCashback DE Erhalte Cashback & Gutscheine safe?
TopCashback DE Erhalte Cashback & Gutscheine is medium risk. Code analysis shows that when a remote flag is on, pages on shops in a server-side allowlist have their full DOM, URL, title and user agent posted to api.onsleek.ai, on page load or when coupons are applied.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Coupon SDK posts full page DOM and URL to api.onsleek.ai on listed shops
Code analysis shows that when a remote flag is on, pages on shops in a server-side allowlist have their full DOM, URL, title and user agent posted to api.onsleek.ai, on page load or when coupons are applied.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a checkout or coupon page on a shop that is on the Sleek allowlist.
Requires the remote SleekEnabled flag and a per-shop coupon setting.
The extension sends the full page markup, address, title and browser string to api.onsleek.ai.
Markup includes input values, iframes and shadow roots.
Support-check fallback and coupon-agent submission in mf.js
Equivalent logic
if (!allowlisted(location.href)) return;const check = await GET('/v2/coupon-agent/support-check', { urlString: location.href, userAgent: navigator.userAgent });if (check.supported === null) { const dom = await captureDomString(); // whole document incl. iframes, shadow roots, input values await POST('/v2/coupon-agent/support-check', { domString: dom, urlString: location.href, title: document.title, userAgent: navigator.userAgent });}// on startCouponAutoApply(codes):await POST('/v3/coupon-agent', { domString: dom, urlString, title, codes, userAgent });- Page markup<html>...<input name="email" value="a@example.com">...</html>
The whole page as it appears to you, including values typed into fields.
- Page addresshttps://shop.example.com/checkout?cart=8812
The full address of the page you are on.
- Page titleCheckout | Example Shop
The title shown on the tab.
- Browser stringMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130.0.0.0
Your browser and operating system.
- api.onsleek.ai
Sleek coupon API. Receives DOM, URL, title and user agent with a Bearer API key bundled in the extension.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.