Is LunaNotes - Take notes on YouTube safe?

Medium risk

LunaNotes returns its stored bearer token to matched YouTube and localhost pages through external messaging.

When a matched page asks for auth state, LunaNotes can respond with the extension's stored bearer token and expiry time. The external messaging allowlist includes LunaNotes pages, YouTube pages, and localhost origins, so the token can be returned outside the extension after the user has authenticated.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Fernando de la Rosav3.6.5Chrome Web Store
40Risk
Who publishes it

Fernando de la Rosa - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Fernando de la Rosa

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed LunaNotes contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • youtube.com

    LunaNotes sends data to youtube.com. One other extension we have analysed sends data here.

  • lunanotes.io

    LunaNotes sends data to lunanotes.io. No other extension we have analysed sends data here.

  • localhost

    LunaNotes sends data to localhost. Named as a recipient by 11 other extensions we have analysed.

Updated 30 September 2026oehoffnnkgcdacmbkhmlbjedinpampak