Is Urban VPN safe?

Question

Is Urban VPN safe?

Accepted Answer

Urban VPN is critical risk. When you fill out a checkout form on any Shopify-powered store, Urban VPN's injected script intercepts the GraphQL API calls that Shopify uses to process your order. These calls carry your full name, street address, city, postal code, phone number, and in some cases GPS coordinates. In a confirmed test on aloyoga.com, 14 separate GraphQL API calls were captured during a single checkout session — all forwarded to Urban VPN's remote server. A SHOPIFY_OTHER_PAGES watcher rule in the extension's remote config specifically targets Shopify checkout URLs, and the extension activates this on stores that match, regardless of whether the VPN connection is in use. Every time the extension starts, it downloads a 1.6 MB compressed instruction file from Urban VPN's server without a notification. This file — transmitted as a binary blob that is not readable text — contains a full rulebook that tells the extension which 133 shopping sites to monitor and exactly what data to extract from each. Because this rulebook lives on the server, not in the extension itself, Urban VPN can add new targets, broaden data collection, or change what gets sent home at any time, with no update to the extension required and no notification to you. 7 further issues were flagged.

Is Urban VPN Proxy safe?

Findings