Is Friends Remover – Bulk Remove Roblox Friends safe?
Friends Remover sends the raw PIN or password for its optional Security Lock feature to a third-party server unhashed.
The extension offers an optional in-app Security Lock so only the user can open the popup, but when that PIN or password is set or checked, the raw value is sent as-is to a Cloudflare Worker for storage and comparison rather than being hashed on the device first. A working SHA-256 hashing function exists in the code but is never called before the value is sent. The request is authenticated with an HMAC signature, so the credential is protected in transit by that signature and TLS, but it still leaves the browser in cleartext.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Friends Remover – Bulk Remove Roblox Friends contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- frlock.elijahoutline10.workers.dev
Friends Remover – Bulk Remove Roblox Friends sends data to frlock.elijahoutline10.workers.dev. No other extension we have analysed sends data here.