Is Maven Tools for Salesforce safe?

Clean risk

Maven Tools for Salesforce reads Salesforce session cookies to call Salesforce APIs for its developer tools.

When used on Salesforce sites, the extension reads the sid session cookie and uses it as a bearer token for Salesforce API requests such as metadata refresh and identity checks. It stores Salesforce session and metadata details in Chrome local storage for the Maven Tools workflow.

Maven Mulev1.4.6Chrome Web Store
1Risk
Who publishes it

Maven Mule Ltd - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Maven Mule
Declared legal entity
Maven Mule Ltd
Registered address
Borovci 15, Zagreb 10000, HR
Registered contact
Maven Mule Ltd
Website
mavenmule.atlassian.net/servicedesk/customer/portal/6

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.4.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.4.6, which we have not unpacked yet.

  • Read and change your data on lightning.force.com

    https://*.lightning.force.com/*

  • Read and change your data on my.salesforce.com

    https://*.my.salesforce.com/*

  • Read and change your data on force.com

    https://*.force.com/*

  • Read and change your data on salesforce.com

    https://*.salesforce.com/*

  • Read and change your data on salesforceliveagent.com

    https://*.salesforceliveagent.com/*

  • Read and change your data on visualforce.com

    https://*.visualforce.com/*

  • Read and change your data on documentforce.com

    https://*.documentforce.com/*

  • Read and change your data on lightning.com

    https://*.lightning.com/*

  • Read and change your data on salesforce-communities

    https://*.salesforce-communities/*

  • Read and change your data on forceusercontent.com

    https://*.forceusercontent.com/*

  • Read and change your data on forcesslreports.com

    https://*.forcesslreports.com/*

  • Read and change your data on salesforce-hub.com

    https://*.salesforce-hub.com/*

  • Read and change your data on maventoolsstorage--test.azurewebsites.net

    https://maventoolsstorage--test.azurewebsites.net/*

  • Read and change your data on maventoolsstorage--prod.azurewebsites.net

    https://maventoolsstorage--prod.azurewebsites.net/*

  • Read and change your data on maventoolsstorage--dev.azurewebsites.net

    https://maventoolsstorage--dev.azurewebsites.net/*

  • Read and change your data on maventoolsstorage--sandbox.azurewebsites.net

    https://maventoolsstorage--sandbox.azurewebsites.net/*

  • Keep running in the background while your browser is open

    background

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Read whatever you have copied to your clipboard

    clipboardRead

  • Write to your clipboard

    clipboardWrite

  • Add items to the right-click menu

    contextMenus

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Run hidden pages in the background

    offscreen

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed Maven Tools for Salesforce contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • *.salesforce.com/services/data

    Maven Tools for Salesforce sends data to *.salesforce.com/services/data. No other extension we have analysed sends data here.

Updated 30 September 2026kgookdjjmmekebgdecakmblghjgiaoem