Is linkding extension safe?

Medium risk

linkding extension sends active-tab URLs during opt-in precaching and can send API tokens over HTTP Linkding URLs.

The extension uses the Linkding server URL and API token configured by the user for bookmark API calls. If the configured server uses HTTP, the API token is sent in cleartext Authorization headers; when precaching is enabled, active tab URLs are sent to the configured server on tab activation and URL changes.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Sascha Ißbrückerv1.15.1Firefox Add-ons
43Risk
Who publishes it

Sascha Ißbrücker - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Sascha Ißbrücker

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

linkding.link
Also called by 3 other listings, including linkding extension
linkding.mydomain.com
Also called by 4 other listings, including linkding extension, linkding injector

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.15.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

Updated 30 September 2026amo-2681100