Is Leetify for Codeforces safe?

Leetify for Codeforces accepts a login session token from any page loaded on localhost:3000, not just its own site.

The extension injects a bridge script on its own web app (leetify-dun.vercel.app) and, for development convenience, also on http://localhost:3000 that listens for a window message carrying an auth token, user name, email, and plan, then hands it to the extension's background worker to store and use as the signed-in session. The listener only checks that the message came from the same window, not that the page is actually the extension's own site, so anything else running on that local port could hand the extension a token and take over the signed-in session. Aside from this login handshake, the extension mainly rewrites the Codeforces problem page with a split-pane editor, dark theme, and difficulty/topic tags, and talks to leetify-dun.vercel.app to save solved problems, notebooks, and calibration data under the signed-in account.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.