Is FunFluen: Fluency Made Fun safe?

Findings

// Wrap window.fetch. For each JSON response containing accessToken and expires,// post the token to the content script, which saves it to extension storage.const origFetch = window.fetch;window.fetch = (...args) => origFetch(...args).then(res => {  res.clone().json().then(j => { if (j?.accessToken && j?.expires) window.postMessage({type:'SAVE_ACCESS_TOKEN', token:j.accessToken}); });  return res;});

// chatgptRequirementsURL = 'https://testi.appforlanguage.com/chat2api/v1/chat/chat-requirements'const reqs = await fetch(chatgptRequirementsURL, {  headers: { Authorization: 'Bearer ' + this.token }}).then(r => r.json());

What it can do

Permissions this extension asks for, as declared in version 1.25.08.31. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

• Read and change your data on funfluen.com

  https://funfluen.com/*

• Read and change your data on appforlanguage.com

  https://appforlanguage.com/*

• Read and change your data on clients5.google.com

  https://clients5.google.com/*

• Read and change your data on youtube.com

  *://youtube.com/*

• Read and change your data on netflix.com

  *://netflix.com/*

• Store data in your browser

  storage

• Store an unlimited amount of data in your browser

  unlimitedStorage

• Speak text aloud

  tts

Where it sends data

Destinations our analysis observed FunFluen: Fluency Made Fun contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• testi.appforlanguage.com

  FunFluen: Fluency Made Fun sends data to testi.appforlanguage.com. One other extension we have analysed sends data here.