Is GrowthBook DevTools safe?

GrowthBook DevTools lets any webpage overwrite its saved API host and API key through a postMessage bridge.

The extension runs a content script on every site and accepts GB_REQUEST_OPEN_VISUAL_EDITOR messages without checking the sender origin. A webpage can save a replacement API host and API key into Chrome sync storage, and later background requests use those saved values for visual changesets and copy transforms.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.