Is Focus Flow safe?

Medium risk

Focus Flow bundles the Mellowtel SDK, which after opt-in loads server-chosen pages in hidden frames and uploads their content.

Focus Flow is a website blocker that includes the Mellowtel SDK. On install it opens an opt-in page on mellow.tel; once the user opts in, the extension connects to ws.mellow.tel, receives URLs to load in hidden frames, and uploads the resulting page HTML, markdown or screenshots to signed storage URLs. This crawling is unrelated to site blocking and runs with access to all sites.

Hunkie Peanutv1.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Focus Flow bundles a crawler SDK that loads server-chosen pages off-screen

Code analysis shows this site blocker bundles the Mellowtel SDK.

After an opt-in on mellow.tel, it can load server-chosen URLs in off-screen frames and upload their content.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You install Focus Flow and accept the Mellowtel opt-in page.

The opt-in tab opens automatically on install or update.

The extension did this

The extension connects to ws.mellow.tel and loads server-chosen URLs in off-screen frames.

Job options the server can set (from the SDK job handler)
  • Target URL
    https://example.com/products/12345

    Which page the extension loads in an off-screen frame.

  • Save markdown
    saveMarkdown: true

    Whether page text is converted and uploaded.

  • HTML visualizer
    htmlVisualizer: true

    Whether a page screenshot is captured and uploaded.

  • Skip headers
    skipHeaders: true

    Whether security headers are stripped from the framed page.

The code that does this

SDK initialisation and opt-in link

Readable version

Init and opt-in on install

background.js:56391
mellowtel = new Mellowtel("24d8f438", { meucci });await mellowtel.initBackground();chrome.runtime.onInstalled.addListener(async () => {  await mellowtel.generateAndOpenOptInLink();});

Opt-in gate before start

background.js:54795
if (!(await getOptIn()).boolean)  throw new Error("User has not opted in yet...");// only after opt-in does start() connect to wss://ws.mellow.tel
Hosts the SDK contacts
    • www.mellow.tel

    Opt-in page opened in a new tab on install or update.

    • ws.mellow.tel

    Websocket that delivers crawl jobs to the extension.

    • api.mellow.tel

    Approval endpoint used by the SDK.

    • mellowtel-bucket.s3.us-east-1.amazonaws.com

    Signed upload target for HTML, markdown and screenshots.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Focus Flow contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Focus Flow sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    Focus Flow sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

  • www.mellow.tel

    Focus Flow sends data to www.mellow.tel. No other extension we have analysed sends data here.

Updated 15 October 2026fnghapbcbeindlipfffoildfkhjepofn