Is Renomate safe?

Renomate's login widget writes the user's account access token into the localStorage of whatever website the tab happens to be on.

Renomate injects a floating login/signup widget into every page the user visits. When the user signs in through that widget, the extension stores the resulting Memberstack access token via localStorage instead of a cookie, and because localStorage is per-origin, the token lands in the storage of whatever unrelated third-party site is loaded at that moment rather than Renomate's own site. That token is later sent as a bearer credential to client.memberstack.com and exchanged for the user's Renomate backend session, so anything with access to that page's localStorage could reuse it to impersonate the account.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.