Is Aura Start safe?
Aura Start embeds a Google OAuth device-flow client secret and sends it to Google's OAuth token endpoint.
The shipped bundle includes a Google OAuth client ID and client secret for its device authorization flow. When users connect Google Drive, the extension requests device codes from oauth2.googleapis.com/device/code and submits the embedded secret to oauth2.googleapis.com/token to exchange or refresh tokens.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Aura Start contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- oauth2.googleapis.com
Aura Start sends data to oauth2.googleapis.com. 13 other extensions we have analysed send data here.