Is MyBib safe?

Question

Is MyBib safe?

Accepted Answer

MyBib is medium risk. MyBib's service worker opens a persistent WebSocket to wss://ws.mybib.com. When the server sends a useTab command, the extension opens the URL the server names in a pinned background tab that is not surfaced to you, loads it using the browser's own logged-in session, reads the full page HTML, and sends it back over the WebSocket. In v1.2.6 the condition that decides when to capture the page was rewritten: the 'page finished loading' branch was moved outside the Cloudflare-challenge check. Code analysis and a deterministic proof-of-concept confirm that a page reaching status='complete' now triggers capture even when it is a Cloudflare challenge page, a small API response, or a 404 — cases the v1.2.4 logic excluded. Whether any capture occurs still depends on the server issuing a useTab command, which an external observer cannot trigger or confirm from the code alone.

Is MyBib: Free Citation Generator safe?

Findings