Is Multiversity LockDown Browser safe?

Multiversity LockDown Browser transmits student name, username, and exam identifiers to a proctoring server and disables all other extensions during exam sessions.

During exam startup, the extension sends student PII — including first name, last name, username, course, and exam identifiers — to smc-service-cloud.respondus2.com, encrypted with a session secret derived from a hardcoded Blowfish ECB key shipped in the extension's code. It also calls chrome.management.setEnabled to disable every installed extension not on an allowlist, re-disabling any that are re-enabled during the exam. When a session begins, it additionally erases all browser form autofill data with no time-scoping, removing entries from all sites and all time.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.