Is Sonarr/Radarr/Lidarr autosearch safe?

Findings

Broad Host Permissions

Flags items that declare overly broad host access patterns, enabling interaction with all websites. This level of access can be exploited to inject scripts into trusted sites and increases the risk of sensitive data exposure, cross-site surveillance, and credential harvesting.

medium

Low Install Count

Flags items lacking installs on the marketplace, suggesting concerns about the extension's reputation and the publisher's reliability.

low

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

CODE INSIGHTS ARE AVAILABLE FOR ENTERPRISE USERS

Permissions

medium

storage

api

Enables persistent data storage for the extension, potentially storing large amounts of user-related information.

low

activeTab

api

Grants temporary access to the current tab's data when triggered by user interaction, limiting scope compared to permanent permissions.

low

contextMenus

api

Allows adding items to browser context menus, potentially intercepting user right-click interactions.

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

low

chrome.action.isEnabled

chrome

/eventPage.chrome.js

low

chrome.action.openPopup

chrome

/eventPage.chrome.js

low

chrome.accessibilityFeatures.animationPolicy

chrome

/eventPage.chrome.js

All API calls are available for Enterprise users

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

URI

/content/js/content_script.js

Unverified

URI

/content/js/content_script.js

Unverified

All secrets are available for Enterprise users

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

http://my.lidarr-url.domain

content/js/core.js

http://my.sonarr-url.domain

content/js/core.js

http://my.readarr-ebook-url.domain

content/js/core.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

bootstrap

Version:

5.3.3

jquery

Version:

3.7.1

All dependencies are available for Enterprise users

Licenses & Compliance

Compliance

Compliance status and certifications for the extension and its publisher

GitHub

GitHub is SOC 2 compliant, as indicated by references to their compliance reports. Furthermore, GitHub's parent company, Microsoft, also maintains SOC 2 compliance, confirming that both the company and its parent adhere to this standard.

Compliant

GitHub

GitHub has explicit statements indicating compliance with GDPR, specifically noting the lawful basis for processing personal data. Furthermore, as a subsidiary of Microsoft, GitHub is also covered under Microsoft's commitments to GDPR compliance.

Compliant

GitHub

GitHub is compliant with PCI DSS v4.0, and they have the service provider attestation available to their customers. Microsoft's website also confirms that Microsoft is compliant with PCI DSS, meaning that both the company and its parent company are compliant with the standards required for handling payment card information.

Compliant

Licenses

No license text available...