Is Payscore safe?

Payscore lets any web page send a logout message that clears saved extension auth state.

Payscore runs a side-panel content script on all URLs and accepts page message events without checking the sender origin. A page can post a logout command that the extension forwards to its background worker, which removes saved Payscore login and identity fields from Chrome sync storage and closes the side panel.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.