Is DeleteTweets- Bulk Delete Tweets safe?
DeleteTweets sends its paid license key over cleartext HTTP and reads your logged-in Twitter/X bearer token to drive bulk tweet deletion.
To bulk-delete or back up tweets, the extension injects a page script into x.com that hooks XMLHttpRequest and captures the logged-in user's Authorization bearer token and x-client-uuid, then replays them against x.com's own GraphQL API; these credentials stay on x.com and are not forwarded to any third party. Separately, license validation requests are built as plain http:// URLs to lemonsqueezy.deletetweets.net carrying the license key in the query string plus a hardcoded set-secret header, so those values travel unencrypted and re-validate roughly every 24 hours.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itLee - 3 other listings from the same operator, none carrying a finding
Lee - 3 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 12k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed DeleteTweets- Bulk Delete Tweets contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- lemonsqueezy.deletetweets.net
DeleteTweets- Bulk Delete Tweets sends data to lemonsqueezy.deletetweets.net. No other extension we have analyzed sends data here.