Is BTRoblox - Making Roblox Better safe?
BTRoblox ships a hardcoded ButterCMS API token in its extension bundle used to fetch blog content.
The extension includes a read-only ButterCMS API token directly in its distributed source file (js/feat/blogfeed.js). The token is sent as a query parameter in requests to api.buttercms.com to retrieve blog feed content displayed within the extension. Any user or researcher who unpacks the extension ZIP or XPI can read the token.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 3.6.21. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on roblox.com
*://*.roblox.com/
Read and change your data on rbxcdn.com
*://*.rbxcdn.com/
Show you desktop notifications
notifications
Add items to the right-click menu
contextMenus
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed BTRoblox - Making Roblox Better contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.buttercms.com
BTRoblox - Making Roblox Better sends data to api.buttercms.com. One other extension we have analyzed sends data here.