Is SEO | ASO | Search Ranking & Keyword Tool safe?
We analyzed SEO | ASO | Search Ranking & Keyword Tool version 0.8.3's actual code and gave it a 55/100 trust score. This useful SEO tool has broad page…
Bottom line
This useful SEO tool has broad page access, page-analysis tracking, and avoidable account-data exposure.
What it can access
It can inspect visible content on every website, exceeding its named search and app-store focus and potentially exposing sensitive displayed text. [Q1][Q2][Q3]
Security weaknesses
It puts an account secret and email into an uninstall web address, creating avoidable exposure if that address is recorded or shared. [Q4]
Signs of misuse
It reports analyzed page addresses to analytics with persistent tracking and promotes related services, extending data collection beyond the core analysis. [Q6][Q12][Q13][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, storage and access to all HTTP/HTTPS pages. Broad page access supports on-page SEO analysis, but is more authority than its automatic Google and app-store features need.
Declares tabs, storage and <all_urls> host access. — manifest.json:23-32
Runs the same content script on named search/app-store sites and on every other HTTP or HTTPS page. — manifest.json:33-80
Which websites can it run on, and can it read or change what appears on those pages?
When the popup is opened, it reads the active page's visible text, title, metadata, links, headings and images for local SEO presentation. It also automatically adds ranking and history controls on Google and app-store pages.
Sends getDocumnetSEOChecker to the active tab after the user opens the popup. — popup.js:1
Responds with document title, body text, metadata, links, images, headings, schema and canonical information, and injects SEO controls on supported sites. — contentScript.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The popup-triggered scan copies visible body text from any active page, which can include sensitive displayed content. It does not read current input values or specifically target password or payment fields.
Clones page HTML, removes script/style/noscript elements and extracts the remaining body's textContent for the SEO report. — contentScript.js:1
Requests that page report only when the extension popup is opened. — popup.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores an AppVector services token in synchronized extension storage and uses it for AppVector services authentication. It then embeds that token and the account email in an AppVector uninstall URL, exposing the secret in URL form.
Saves a user-entered and server-validated token plus returned email in chrome.storage.sync. — popup.js:1
Adds the token to Authorization headers and constructs an uninstall URL containing token and email query parameters. — background.js:1
Requests no cookies, history, bookmarks or downloads permission. — manifest.json:23-32
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
User-facing controls can copy search and app-store result data to the clipboard. No clipboard reading, local-file, location, camera, microphone, screen or native-app access was found.
Uses navigator.clipboard.writeText and document.execCommand('copy') from explicit copy buttons. — contentScript.js:1
Declares no device, capture, file-system or native-messaging permission. — manifest.json:23-32
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The active URL, title, persistent client ID and potentially the AppVector email go to Google Analytics when the popup opens. Search keywords, titles and result URLs go to a fixed keyword-scoring service; tested URLs go to Google's PageSpeed services.
POSTs Extension_clicked to google-analytics.com with page_location, page_title, client_id and user_id. — popup.js:1
Sends keyword scoring to js-apis.maakeetoo.com, selectors to intelligence.multivariate.tech, page URLs to Google's PageSpeed API and authenticated product calls to appvector.io. — background.js:1
Includes token and email in the appvector.io uninstall-extension URL. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
A remote service supplies CSS selectors cached for 24 hours, and AppVector supplies chart and ranking data rendered into supported pages. These are active configuration/data paths, but no response is evaluated as JavaScript or loaded as an extension script.
Fetches dynamicSelector data from intelligence.multivariate.tech and caches it for one day. — background.js:1
Uses remote selectorOne/selectorTwo values to locate Google result cards and renders AppVector API data. — contentScript.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It opens AppVector onboarding at installation, automatically augments Google and app-store pages, and redirects selected legacy AppVector routes. General-page SEO extraction requires opening the popup, while token capture requires visiting the AppVector token page.
Opens the fixed AppVector token onboarding URL on first installation. — background.js:1
Automatically activates search/app-store enhancements based on the current URL. — contentScript.js:1
Replaces selected old AppVector paths with fixed AppVector/SearchVector dashboard routes. — appVectorRedirect.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no search, homepage, proxy, privacy or browser-settings permission. — manifest.json:23-32
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The 108 KB page access and 20 KB popup script are minified bundles. Names, destinations and feature branches remain readable, but minification makes exhaustive manual flow review harder.
Records a 107,906-byte contentScript.js and 19,562-byte popup.js. — inventory.json:1
Uses compact variable names while retaining readable endpoints, actions, selectors and UI strings. — contentScript.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All packaged JavaScript and HTML were checked for dynamic-code primitives. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
Each time the popup opens, the exact active URL and page title are reported to Google Analytics with a persistent client identifier. This is extension-use telemetry, not continuous history enumeration, but it discloses which page the user analyzed.
Queries the active tab, builds Extension_clicked parameters with page_location and page_title, and POSTs them to Google Analytics. — popup.js:1
Requests tabs access but not the history permission. — manifest.json:23-32
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent random Google Analytics client ID and a session ID. Analytics can also include the stored AppVector account email as user_id, tying analyzed-page events to an account.
Creates crypto.randomUUID clientId in local storage, a session identifier in session storage and attaches encoded userId to events. — popup.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The AppVector token is intentionally sent to AppVector as an Authorization credential, which is normal authentication. Separately placing the token and email in the uninstall URL is an avoidable exposure; no credential transfer to an unrelated party was demonstrated.
Uses Authorization: Token for fixed appvector.io endpoints. — background.js:1
Calls chrome.runtime.setUninstallURL with token and email query parameters on appvector.io. — background.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It reads visible page text and SEO metadata after the user opens the popup, and automatically reads search/app-store result content on supported sites. It writes selected exports to the clipboard but does not monitor keystrokes, capture screens or read the clipboard.
Extracts body text, headings, links, images and metadata for getDocumnetSEOChecker and parses supported search/store pages. — contentScript.js:1
Clipboard operations are write-only and attached to explicit copy actions. — contentScript.js:1
Can a website or remote server send commands that make the extension take actions?
Remote selector configuration influences which Google result elements are analyzed, and AppVector responses supply charts and labels inserted into supported pages. These controls are limited to the packaged SEO/ASO features; general server-directed script execution was not demonstrated.
Fetches selector configuration and fixed-path AppVector data. — background.js:1
Uses returned selectors and structured data to locate and augment search/app-store elements. — contentScript.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It inserts related NextGrowth Labs/AppVector links and UTM-tagged PageSpeed links into SEO results and the popup. These promote the developer's related services; they do not replace unrelated page destinations or alter shopping carts.
Adds NextGrowth Labs PageSpeed assessment and attribution links to generated SEO UI. — contentScript.js:1
Contains AppVector and NextGrowth Labs promotional links with search_extension UTM parameters. — popup.html:20-35,545-569
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, webRequest, declarativeNetRequest or downloads permission. — manifest.json:23-32
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission; reviewed endpoints are public HTTPS services. — manifest.json:23-32
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses a Base64 Basic Authorization value as a fixed API credential; responses are parsed as JSON rather than executed. — background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no externally_connectable or web_accessible_resources entry. — manifest.json:1-81
Uses chrome.runtime messaging but does not forward window.postMessage or DOM events from page code into privileged actions. — contentScript.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines special branches for Google search, Google Play, Apple App Store and AppVector routes. — manifest.json:33-80
Caches remotely returned selectors for 24 hours. — background.js:1
Lets the user maintain a local list of domains to rank-highlight in Google results. — optional.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Package contents are localized UI, SEO parsing, ranking charts, API calls and static assets. — inventory.json:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
DOM writes create ranking, history, chart and copy controls; no form-action or submission rewriting path was found. — contentScript.js:1