Is Google Analytics UTM Builder safe?

Google Analytics UTM Builder ships its developer's confidential Bitly OAuth client secret hardcoded in the extension bundle.

The extension builds and manages UTM-tagged campaign URLs, with optional shared workspaces synced through its backend at utm-builder.trafikant.pro. When you connect Bitly to shorten links, the extension exchanges the OAuth code using a confidential client_secret that is embedded in plain text in background.bundle.js, so any user can extract it. Link shortening goes through Bitly, and the extension also loads Google Analytics and Sentry error reporting.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.