Is LeetCode Tracker safe?
LeetCode Tracker includes a GitHub OAuth client secret in its extension bundle.
LeetCode Tracker ships a GitHub OAuth client secret and client ID in its source code. During GitHub authorization, it sends those values together with the OAuth code to GitHub's access-token endpoint.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed LeetCode Tracker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- github.com/login/oauth/access_token
LeetCode Tracker sends data to github.com/login/oauth/access_token. One other extension we have analysed sends data here.