Is Vinted Scraper - One-Click Data Export safe?

Vinted Scraper - One-Click Data Export broadcasts every API response on Vinted pages to any script sharing the page via postMessage.

On every Vinted page load, the extension injects a script into the page itself that intercepts all of the page's own fetch and XMLHttpRequest calls and rebroadcasts their full response bodies with window.postMessage, using '*' as the target origin. This includes authenticated responses like inbox messages, order details, and payout information, and because the target origin is unrestricted, any other script running in that same page (for example a compromised third-party tag) can read the same data by listening for the message event. The extension uses this same broadcast to power its own listing/price export feature.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.