Is Pocus safe?

Pocus exposes scraped CRM and sales-page details to arbitrary embedded frames through an unauthenticated message bridge.

On supported sites such as LinkedIn, Gong, Salesloft, Apollo, HubSpot, Outreach, and Salesforce, its broad content script builds an embed query from the page URL and page content. Any child frame on those pages can request that payload and related HubSpot, Salesforce, or company-slug fallback data because replies are posted without origin checks.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.