Is DeleteTweets safe?

DeleteTweets sends its paid license key over cleartext HTTP and reads your logged-in Twitter/X bearer token to drive bulk tweet deletion.

To bulk-delete or back up tweets, the extension injects a page script into x.com that hooks XMLHttpRequest and captures the logged-in user's Authorization bearer token and x-client-uuid, then replays them against x.com's own GraphQL API; these credentials stay on x.com and are not forwarded to any third party. Separately, license validation requests are built as plain http:// URLs to lemonsqueezy.deletetweets.net carrying the license key in the query string plus a hardcoded set-secret header, so those values travel unencrypted and re-validate roughly every 24 hours.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.