Is focus-to-do-pomodoro-time safe?

Question

Accepted Answer

focus-to-do-pomodoro-time is medium risk. Focus To-Do embeds its real-time message broker credentials directly in the publicly distributed extension bundle. The broker password is written in plaintext in the extension's JavaScript, readable by anyone who downloads the extension from the Chrome Web Store. Analysis confirmed the credentials are accepted by the live ActiveMQ broker at mq.focustodo.net. An attacker who also obtains a target user's account ID — which the extension includes in its error-reporting calls — can subscribe to that user's private channel and deliver commands that force a logout, trigger a data synchronization, simulate a successful purchase, or refresh account information.

Is Focus To-Do: Pomodoro Timer & To Do List safe?

Findings