Is BTRoblox - Making Roblox Better safe?

BTRoblox ships a hardcoded ButterCMS API token in its extension bundle used to fetch blog content.

The extension includes a read-only ButterCMS API token directly in its distributed source file (js/feat/blogfeed.js). The token is sent as a query parameter in requests to api.buttercms.com to retrieve blog feed content displayed within the extension. Any user or researcher who unpacks the extension ZIP or XPI can read the token.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.