Is RikoSub safe?

RikoSub exposes the user's netflixsubs.app auth token to the page via a wildcard postMessage, readable by any other script sharing the page.

On every load of YouTube, Netflix, Coursera, Prime Video, and Amazon pages, RikoSub's content script reads its stored settings, including the user's netflixsubs.app account token, and broadcasts them into the page using window.postMessage with a wildcard target origin. The extension's own injected script picks this up and stores the token as a plain page-global variable, where any other script running in that same page can read it. That token is later sent to the vendor's own backend as a bearer credential to unlock the user's paid subtitle features.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.