Is TRAVIC-Sign safe?

TRAVIC-Sign runs content scripts on all URLs and allows its local native signing host to direct credentialed HTTP requests to arbitrary URLs.

TRAVIC-Sign bridges web pages to the local TRAVIC digital-signing application via native messaging (de.ppi.travic.sign). Its content scripts activate on every HTTP/S and file URL, scanning all frames for embed or object elements that match a TRAVIC MIME type. Once connected, the native host can instruct the extension to issue credentialed GET or POST requests — attaching session cookies — to any URL it specifies, and inject the response into the current page.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.