Is Assessment Lock (Vretta) safe?

Question

Accepted Answer

Assessment Lock (Vretta) is high risk. Code analysis shows a second hardcoded master password — distinct from the background service worker bypass — embedded in the content script at content.js line 75. The 50-character constant 'qg8FC2TGM2QNsK4zYRJqWDMR78NQ7Dfjkj9skJ4QyqpqX2D2' satisfies the UI-layer password gate when entered at the 'End Assessment' prompt. The gate at content.js line 597 evaluates whether the entered string equals this constant; when it does, deactivation proceeds regardless of what supervisor password was configured at the start of the session. The constant is present in the publicly downloadable extension bundle. Code analysis shows that Assessment Lock (Vretta) v1.10.2 contains the hardcoded string 'vretta123' in its background service worker as a universal password that exits exam lockdown on any session. Any JavaScript running on the assessment page can send a single window.postMessage command with this value to deactivate lockdown — bypassing the password prompt, re-enabling blocked browser extensions, and exiting fullscreen — without supervisor involvement. The string is recoverable from the publicly downloadable extension package in seconds.

Is Assessment Lock (Vretta) safe?

Findings