Is Superhuman Docs Browser Extension safe?
Coda Browser Extension creates a Coda API token on request and stores the bearer token in Chrome sync storage.
When the user creates a token from the popup, the service worker reads the coda.io csrf_token cookie and posts to coda.io/internalAppApi/account/tokens with account credentials included. It saves the returned token secret as codaClipperKey in chrome.storage.sync and later uses it as a Bearer token for Coda API requests.
Who publishes itCoda Project - no other listings under this identity, 3 shared hostnames
Coda Project - no other listings under this identity, 3 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Superhuman Docs Browser Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- coda.io
Superhuman Docs Browser Extension sends data to coda.io. No other extension we have analysed sends data here.
- Chrome sync storage
Superhuman Docs Browser Extension sends data to Chrome sync storage. Named as a recipient in this extension's own analysis.