Is WhatRuns safe?

Question

Is WhatRuns safe?

Accepted Answer

WhatRuns is high risk. Every time you navigate to a new website, WhatRuns sends that site's hostname and full URL to its own servers at whatruns.com/api/v1/get_site_apps — without asking and without an opt-out. If you are logged into WhatRuns, your email address and API key are also included in the request (base64-encoded). This was confirmed by live traffic capture: five separate POST requests were observed — one each for example.com, wikipedia.org, github.com, and reddit.com — all fired automatically by the extension's background service worker. Our dynamic analysis captured POST requests to https://www.whatruns.com/api/v1/analyse/path on every page navigation. Each request included the full page URL, document title, referrer, and a persistent UUID stored in chrome.storage.local. The same UUID — d45bfbf41ccd49899dddebba958c111b — appeared across navigations to unrelated sites including facebook.com, github.com, and wikipedia.org, enabling the server to correlate browsing history under a single persistent identifier. This behavior was introduced in version 1.10.0 and was not present in v1.8.20.

Is WhatRuns safe?

Findings