Is Redux DevTools safe?

Redux DevTools exposes full Redux application state and action dispatch to any other installed Chrome extension.

The extension sets externally_connectable to allow connections from all extension IDs ('*'). Any installed extension that connects with a port name beginning with 'monitor' receives every Redux state update (actions, computed states, and partial states) from all monitored web apps via the background script's message relay. The same open message handler also accepts arbitrary Redux actions from external extensions and forwards DISPATCH commands back into monitored web application tabs, with no sender ID allowlist or authentication check.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.