Is Preveo – Web Quality & Product Communication Toolkit safe?
We analyzed Preveo – Web Quality & Product Communication Toolkit version 2.0.2's actual code and gave it a 62/100 trust score. Preveo is purpose-aligned…
Bottom line
Preveo is purpose-aligned but has broad capture and sensitive-data access that requires careful user control.
What it can access
It can capture tabs, screens, audio, cookies and page storage, with optional access across all sites for previews.[Q1][Q3][Q4][Q5]
Security weaknesses
Preveo pages can trigger tab rule changes, including weakening frame protections, while localhost pages also participate in the trusted bridge.[Q16][Q18][Q19]
Signs of misuse
Captured media and optional cookies or storage are sent to Preveo for reports, with no evidence of covert collection or unrelated misuse.[Q6][Q14][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests active-tab, cookies, debugger, scripting, tabs, tab-capture, offscreen and request-rule access. All-site access is optional and requested for advanced previews and capture.
Declares powerful capture, debugger and page-control permissions plus optional <all_urls> access. — manifest.json:39-54
Which websites can it run on, and can it read or change what appears on those pages?
It can screenshot the active tab, execute storage-reading helpers and use Chrome's debugger to emulate page size, touch, zoom and user agent. These are central to its web-quality testing features.
Uses debugger commands for device metrics, touch, user agent, viewport measurement, screenshots and screencast frames. — background.js:1
Captures the active tab and runs localStorage/sessionStorage extraction helpers when selected. — chunks/popup-BunZzJBO.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Screenshots and recordings may visibly include passwords, payment details or other sensitive page content. Optional cookie and web-storage capture may also include authentication values.
captureTabContext can combine a screenshot with cookies, localStorage and sessionStorage from the active page. — chunks/popup-BunZzJBO.js:1
MediaRecorder records the chosen current tab, window or screen. — chunks/background-media-runtime-XI8dgdYz.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
When the user enables Read Cookies, it collects all cookies available for the active page URL and includes their names and values in the test data. The option defaults off.
getCookiesForUrl calls chrome.cookies.getAll({url}) and converts every returned name and value into report data. — chunks/popup-BunZzJBO.js:1
Capture preferences default cookie, localStorage and sessionStorage collection to false and expose separate user toggles. — chunks/popup-BunZzJBO.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It records the current tab, a user-selected window or the screen, and can mix in a selected microphone. It also captures screenshots; no location, local-file or native-app access was found.
Uses tab media, getDisplayMedia, getUserMedia and MediaRecorder for user-selected video and optional microphone audio. — chunks/background-media-runtime-XI8dgdYz.js:1
Uses captureVisibleTab and Page.captureScreenshot for still images. — background.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Screenshots, recordings, page URLs, test configuration and any enabled cookies or storage values are submitted to services.preveo.io and presigned storage URLs. Authentication is sent as a bearer token to Preveo.
Requests upload URLs from /api/v1/blob/generate-upload-url, PUTs media blobs, then submits layer jobs and captured context to api.preveo.io. — background.js:1
The API client attaches the stored Preveo authentication token as Authorization metadata. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Remote responses supply data for upload, job status and result links; executable behavior remains in packaged code. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Capture and recording begin through popup actions, with permission toggles and a visible countdown. — chunks/popup-BunZzJBO.js:1
The background resumes pending user-created upload jobs and polls their result status. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Debugger commands set device metrics, touch events and user agent while tabs.setZoom temporarily normalizes zoom. — background.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The popup is a 937 KB compiled bundle and the background worker is 243 KB. They are minified but retain readable names, services and complete feature flows; no deliberate obfuscation was found.
Records the compiled popup, background, content bridge and recording runtime sizes. — inventory.json:1
Application symbols and user-facing strings remain readable throughout the minified bundle. — background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All executable JavaScript files were checked for dynamic-code primitives. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Capture context uses only the resolved active tab URL selected for testing. — chunks/popup-BunZzJBO.js:1
Configures OpenTelemetry export to https://otel.preveo.io/v1/traces for API operations. — background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It stores the signed-in Preveo user and profile IDs with the authentication token. No separate advertising ID, browser fingerprint or cross-site tracking identifier was found.
Copies the Preveo auth token, profile ID, name, alias, photo and theme from the signed-in Preveo page into extension storage. — content-scripts/content.js:1
Uses account identifiers for authenticated Preveo API requests and selected workspace entities. — chunks/popup-BunZzJBO.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
A report may send screenshots, video, audio, URLs and—if separately enabled—page cookies and storage values to Preveo. The interface labels these optional sensitive captures and leaves them disabled by default.
The Allowed Permissions screen offers separate Read Cookies, Read LocalStorage and Read SessionStorage toggles, described as included in stored reports. — chunks/popup-BunZzJBO.js:1
Layer job payloads include cookies, localStorage, sessionStorage and uploaded media paths. — background.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It captures screenshots, screen video and optional microphone audio after user action. It does not monitor typing or clipboard activity.
Records user-selected display or tab streams and an optional selected microphone, with a visible countdown and browser capture prompt. — chunks/background-media-runtime-XI8dgdYz.js:1
Screenshot and recording controls prepare and submit the captured media. — chunks/popup-BunZzJBO.js:1
Can a website or remote server send commands that make the extension take actions?
Preveo platform pages can ask the extension to enable or disable iframe header overrides for their own tab. Sender checks restrict this bridge to Preveo or localhost platform pages.
Accepts same-window, same-origin set-iframe-header-override messages on configured Preveo and local pages. — content-scripts/content.js:1
Verifies the sender is a preveo.io, localhost or 127.0.0.1 /platform page before changing rules for that tab. — background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
External navigation is limited to visible Preveo product, account, result and wallet actions. — chunks/popup-BunZzJBO.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
For live iframe previews, it can remove X-Frame-Options and Content-Security-Policy response headers from subframes in the selected tab. This requires optional all-site access and an approved Preveo preview page.
updateSessionRules removes x-frame-options, content-security-policy and content-security-policy-report-only from sub_frame responses for one tab. — background.js:1
Refuses to enable the rule without <all_urls> permission and sender validation. — background.js:1
Can it communicate with software on the computer or services running on localhost?
Its content bridge intentionally runs on localhost and 127.0.0.1 as well as preveo.io. Local /platform pages can sync a Preveo token and request preview header overrides, matching development support but expanding trust to local services.
The content script matches *.preveo.io, localhost and 127.0.0.1. — manifest.json:58-68
Reads Preveo-style auth fields and bridges the header-override command on platform or dashboard pages. — content-scripts/content.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Decodes screencast image frames into bitmaps for a recorded canvas. — chunks/background-media-runtime-XI8dgdYz.js:1
Captured media is converted to WebP or WebM and uploaded as data. — background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no web_accessible_resources or externally_connectable declaration. — manifest.json:1-70
The only page-message bridge checks source, origin, message type and request ID. — content-scripts/content.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Background activation follows runtime messages, storage changes, alarms and explicit commands. — background.js:1
Capture settings and use cases are presented directly in the popup. — chunks/popup-BunZzJBO.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Resource use is tied to MediaRecorder and responsive-device frame composition during an active recording. — chunks/background-media-runtime-XI8dgdYz.js:1
A 30-second alarm polls only while submitted layer jobs await results. — background.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Injected helpers display a recording countdown, wait for page readiness and apply requested testing effects. — background.js:1
Injected storage helpers read key/value pairs without editing page forms or inputs. — chunks/popup-BunZzJBO.js:1