Is Vindy | Boost Vinted Sales safe?

Medium risk

Vindy sends Vinted draft-debug reports with listing and user details to a hardcoded Discord webhook.

When Vinted draft creation fails during repost or restore flows, the extension posts debug reports to a Discord webhook. Those reports can include the stored Vinted login and user ID, Vinted domain, product ID, draft request and response data, and listing metadata with photos removed. The extension also rewrites Origin and Sec-Fetch-Site headers for requests to Vinted domains.

alessandroirace3971v3.99.13Chrome Web Store
45Risk
Who publishes it

alessandroirace3971 - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
alessandroirace3971
Website
vindy.tech/#contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Vinted draft-debug reports post listing data to a Discord webhook

When a Vinted draft creation or restore flow fails, Vindy sends a debug report to a hardcoded Discord webhook.

It can include your stored login/user ID, listing domain and product ID, draft data, and item details with photos removed.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

A user action starts a Vinted repost or restore flow that reaches a draft creation failure path.

The extension did this

The extension posts Vinted draft-debug reports with listing data to a hardcoded Discord webhook.

Captured request
POSThttps://discordapp.com/api/webhooks/1489313073457004624/<redacted>
Fields in the request
  • Your stored login or user ID
    user_12345 (illustrative)

    Identifies the Vinted account or extension user associated with the draft-debug report.

  • Stored extension data
    chrome.storage.local user record (illustrative)

    Includes values read from extension storage and attached to the draft-debug report.

  • Listing and draft content
    productId 987654321 with draft payload fields (illustrative)

    Shows the product ID, domain, draft payload, draft response, and item details involved in the failed draft flow.

  • Request headers
    content-type: application/json (illustrative)

    Provides request context that can tie the report to the browser session or Vinted request handling.

Where it sends data

Destinations our analysis observed Vindy | Boost Vinted Sales contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • discordapp.com

    Vindy | Boost Vinted Sales sends data to discordapp.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026okfhalihmbfiejmplacjckejkhamkiab