Is Dictionary to Notion safe?

Dictionary to Notion accepts Notion login tokens from any page served on http://localhost:3000, not just its own OAuth flow.

The extension looks up words on double-click and saves definitions to a Notion database using a stored access token and database ID. Its manifest allow-lists both the vendor's own OAuth-relay domain and http://localhost:3000/* for external messages, and the handler that receives those messages stores whatever accessToken and databaseId it is given without checking where the message actually came from. That means any local process able to serve a page on port 3000 during the OAuth window can silently overwrite the stored Notion credentials.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.