Is YAML Validator safe?
YAML Validator sends usage telemetry to PostHog despite its store listing claiming your data never leaves your machine.
On github.com blob pages, the extension's injected 'Fold' button reports the exact page URL (including private-repo paths) to PostHog on every click, along with a persistent anonymous ID and browser/OS/locale details. Separately, the popup validator sends metadata about each YAML you validate (byte count, line count, error type/line, detected schema) to the same PostHog endpoint, session-tracked with a persistent anonymous ID and device fingerprint. This contradicts the extension's own Chrome Web Store description, which states the code is never sent to a server and stays private on your device — only the raw YAML content itself is withheld, not the surrounding telemetry.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed YAML Validator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- eu.i.posthog.com
YAML Validator sends data to eu.i.posthog.com. 13 other extensions we have analyzed send data here.