Is Add to Microsoft To Do safe?

Add to Microsoft To Do stores Microsoft OAuth tokens in sync storage encrypted with a hardcoded AES key bundled in the extension source.

The extension lets users add tasks to Microsoft To Do via a browser action popup. It authenticates with Microsoft OAuth and stores the resulting access_token and refresh_token in chrome.storage.sync, encrypting them with CryptoJS AES using a fixed password hardcoded in background.js. Because the encryption key is shipped with the extension, anyone who obtains the sync storage blob — for example via a Google Sync backup or malware on the device — can decrypt all stored tokens without any additional secrets.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.