Is Google Pagespeed Insights safe?

Google Pagespeed Insights ships hardcoded SMTP credentials and fetches remote-controlled HTML ads into its popup on every open.

The extension bundles plaintext ElasticEmail SMTP credentials and a Google PageSpeed API key directly in its source code, transmitting them via smtpjs.com on bug-report submissions. On every popup load it also fetches ad HTML and CSS from appwrk.com and injects both unsanitized into the popup DOM via insertAdjacentHTML, giving the remote server the ability to change popup content at will.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.