Is Cronofy safe?

Cronofy lets Gmail pages request the stored Cronofy scheduler auth token from the extension.

Any script running in the mail.google.com page context can send the scheduler-user-state message and receive the extension-chrome-token value from local extension storage. The returned value is a Cronofy scheduler auth token, so this summary is limited to credential access through Gmail pages rather than a network transfer.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.