Is Authenticator safe?

Authenticator embeds OAuth client secrets for Google Drive and Microsoft OneDrive in plaintext within its extension bundle.

The extension stores OAuth client_secret values for both Google Drive and Microsoft OneDrive directly in its JavaScript files (background.js and popup.js). These secrets are transmitted to Google and Microsoft token endpoints during authorization and token refresh flows. Anyone who unpacks the extension can read these credentials, which are confidential application-level secrets not intended for client-side distribution.