Is PubPeer safe?

PubPeer queries its API on each page load and injects comment-link banners into matching academic publication pages.

On every page load, PubPeer sends the current URL to pubpeer.com/v3/publications to check for associated peer-review comments. When comments exist, the extension injects a banner into the page with links back to PubPeer. A URL value returned by the API is embedded into the banner's innerHTML without sanitization in the retracted/flagged-publication code path, which could allow a malformed API response to inject content into the visited page.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.