Is DF YouTube (Distraction Free) safe?

DF YouTube (Distraction Free) ships a hardcoded Mailgun API private key inside the extension package.

The extension bundles a plaintext Mailgun API credential in leave_feedback.js, which is used to authenticate feedback submissions to a Mailgun sandbox endpoint. Any user who installs the extension or inspects the .xpi archive can read the key directly; no runtime secret fetch occurs.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.