Is Focus To-Do: Pomodoro Timer & To Do List safe?

Medium risk

Focus To-Do ships hardcoded STOMP broker credentials in its bundle, connecting all users to a shared message queue at mq.focustodo.net.

The extension connects to a WebSocket STOMP broker (wss://mq.focustodo.net:61615) using a fixed username and password embedded in the JavaScript bundle. Each user is filtered to their own queue slot via a UID selector, but the shared credentials can be used by anyone who extracts them from the extension to subscribe to another user's topic or send control commands (SYNC, LOGOUT, PURCHASE_SUCCESS, UPDATE_USER_INFO). The user UID needed to target a specific account is separately exposed in error-reporting calls made by the extension.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Pomodoro Timer & To Do List - SuperElement Softv7.1.1Chrome Web Store
45Risk
Who publishes it

Pomodoro Timer & To Do List - SuperElement Soft - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Pomodoro Timer & To Do List - SuperElement Soft
Registered contact
高阳
Website
www.focustodo.cn

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 7.1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Show you desktop notifications

    notifications

  • Read information about your displays

    system.display

Where it sends data

Destinations our analysis observed Focus To-Do: Pomodoro Timer & To Do List contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mq.focustodo.net

    Focus To-Do: Pomodoro Timer & To Do List sends data to mq.focustodo.net. No other extension we have analysed sends data here.

Updated 30 September 2026ngceodoilcgpmkijopinlkmohnfifjfb