Is Google Apps Script GitHub Assistant safe?

Google Apps Script GitHub Assistant ships hardcoded Bitbucket OAuth2 credentials that any party can extract from the extension bundle.

The extension embeds a base64-encoded Bitbucket OAuth2 consumer key and secret directly in its source files (src/scm/bitbucket.js and options/options.js). These credentials are sent to bitbucket.org to obtain OAuth access tokens, and any user or automated tool that unpacks the extension can decode them and use them to request tokens under the extension's registered OAuth consumer. The exposure is static — it exists regardless of whether the user has a Bitbucket account.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.