Is Dictionary to Notion safe?
Dictionary to Notion accepts Notion login tokens from any page served on http://localhost:3000, not just its own OAuth flow.
The extension looks up words on double-click and saves definitions to a Notion database using a stored access token and database ID. Its manifest allow-lists both the vendor's own OAuth-relay domain and http://localhost:3000/* for external messages, and the handler that receives those messages stores whatever accessToken and databaseId it is given without checking where the message actually came from. That means any local process able to serve a page on port 3000 during the OAuth window can silently overwrite the stored Notion credentials.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 0.03. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Run hidden pages in the background
offscreen
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Dictionary to Notion contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.notion.com
Dictionary to Notion sends data to api.notion.com. 6 other extensions we have analyzed send data here.
- dictionary.danielhe.art
Dictionary to Notion sends data to dictionary.danielhe.art. No other extension we have analyzed sends data here.