Is MAL-Sync safe?
MAL-Sync embeds hardcoded OAuth client secrets for three third-party services in its extension bundle.
MAL-Sync stores OAuth client_secret values for Shikimori, MangaBaka, and Simkl directly in its JavaScript source files. These secrets are sent in POST requests to each service's token endpoint during authorization and token refresh flows. Any party who obtains a valid authorization code for these apps could use the embedded secret to exchange it for an access token appearing to originate from MAL-Sync.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itlolamtisch - no other listings under this identity
lolamtisch - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 0.12.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on myanimelist.net
https://myanimelist.net/
Read and change your data on cdn.myanimelist.net
https://cdn.myanimelist.net/
Read and change your data on kissanimelist.firebaseio.com
https://kissanimelist.firebaseio.com/
Read and change your data on anilist.co
https://*.anilist.co/
Read and change your data on graphql.anilist.co
https://graphql.anilist.co/
Read and change your data on kitsu.app
https://kitsu.app/
Read and change your data on media.kitsu.app
https://media.kitsu.app/
Read and change your data on api.simkl.com
https://api.simkl.com/
Read and change your data on www.netflix.com
https://www.netflix.com/
Read and change your data on discover.hulu.com
https://discover.hulu.com/
Read and change your data on www.primevideo.com
https://www.primevideo.com/
Read and change your data on www.crunchyroll.com
https://www.crunchyroll.com/
Read and change your data on api.malsync.moe
https://api.malsync.moe/
Read and change your data on chibi.malsync.moe
https://chibi.malsync.moe/
Read and change your data on api.myanimelist.net
https://api.myanimelist.net/
Read and change your data on api.mangadex.org
https://api.mangadex.org/
Read and change your data on api.mangabaka.org
https://api.mangabaka.org/
Read and change your data on mangabaka.org
https://*.mangabaka.org/
Read and change your data on shikimori.io
https://shikimori.io/
Read and change your data on plex.direct
https://*.plex.direct/
Store data in your browser
storage
Schedule its own background tasks
alarms
Show you desktop notifications
notifications
Where it sends data
Destinations our analysis observed MAL-Sync contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.simkl.com
MAL-Sync sends data to api.simkl.com. One other extension we have analyzed sends data here.
- mangabaka.org
MAL-Sync sends data to mangabaka.org. No other extension we have analyzed sends data here.
- shikimori.one
MAL-Sync sends data to shikimori.one. No other extension we have analyzed sends data here.