Is 백준허브(BaekjoonHub) safe?

BaekjoonHub ships a hardcoded GitHub OAuth client_secret that any user or actor can extract from the extension bundle.

The extension bundles its GitHub OAuth app client_secret as a plaintext constant in scripts/oauth2.js and scripts/authorize.js. During the login flow, this secret is sent alongside the user's authorization code in a POST request to github.com/login/oauth/access_token. Anyone who extracts the secret from the published extension can independently use it with a valid authorization code to obtain a GitHub OAuth token with full read/write access to the user's repositories.