Is Welo Data Assistant safe?
Welo Data Assistant is high risk. On matched rating platforms the extension starts Sentry session replay automatically and uploads a recording segment to sentry.welocalize.tools. Inputs are masked; page text and URL are recorded unmasked.
Who publishes itWelocalize, Inc. - no other listings under this identity
Welocalize, Inc. - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Session replay tool records unmasked page text on rating platforms
On matched rating platforms the extension starts Sentry session replay automatically and uploads a recording segment to sentry.welocalize.tools.
Inputs are masked; page text and URL are recorded unmasked.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a supported rating page, such as feather.openai.com or rating.ewoq.google.com, with the extension installed.
No login or specific action is required beyond loading the page.
The extension's content script initializes Sentry session replay and uploads a recording segment to sentry.welocalize.tools.
The replay configuration masks typed input values but leaves ordinary page text, the URL, and the page title unmasked.
Envelope header: {event_id, sent_at, sdk: "sentry.javascript.browser", dsn: "https://d5580c2d5202ec3f9efed059648c7541@sentry.welocalize.tools/11"}Item 1 header: {"type":"replay_event"}Item 1 payload: {"type":"replay_event","replay_id":"59c6091f5cc44a05bdee4cb53b640ac5","segment_id":0,"replay_type":"session"}Item 2 header: {"type":"replay_recording","length":10193}Item 2 payload: [rrweb-format compressed recording binary, 10193 bytes; not extracted in this capture, see caveat]- Visible page textRate the relevance of this result for the query "best hiking boots 2026"
On-screen text on the matched page is captured because text masking is turned off.
- Page URLhttps://rating.ewoq.google.com/task/8823f10c
The full URL of the page is attached to every replay session sent to Sentry.
- Page titleEWOQ - Task Review
The browser tab title is recorded alongside the replay segment.
- Typed input values[Masked by Sentry: maskAllInputs]
Text typed into form fields is masked by Sentry and excluded from the replay.
Replay integration configuration in content-script/index.js
Sentry.init({ dsn: sentryDsn, // https://...@sentry.welocalize.tools/11 environment: "production", tracesSampleRate: 1, replaysSessionSampleRate: 0.1, replaysOnErrorSampleRate: 1, sendDefaultPii: false, skipBrowserExtensionCheck: true, integrations: [ Sentry.browserTracingIntegration(), Sentry.replayIntegration({ maskAllText: false, maskAllInputs: true, blockAllMedia: false }) ], beforeSend: (event) => { /* attaches app/context/platform tags */ }})- sentry.welocalize.tools
Receives and stores session-replay recordings and error events. A Sentry project hosted on the extension vendor's (Welocalize / Welo Data) own domain.
EWOQ and RaterHub never rendered an authenticated task page in testing; Feather showed a Cloudflare challenge instead. Replay still activated and uploaded regardless. Its on-screen text could not be extracted from this capture.