Is Salesforce DevTools safe?
Salesforce DevTools embeds a hardcoded OAuth client secret in its source that any user can extract from the CRX file.
The extension stores a Salesforce Connected App client ID and client secret as plaintext constants in its bundled JavaScript. These credentials are used to authenticate with Salesforce's OAuth2 endpoint and could be extracted by anyone who downloads the extension package. Additionally, when users interact with the popup, the full URL of the active Salesforce page is transmitted to Google Analytics.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itxgeek.net - no other listings under this identity
xgeek.net - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Salesforce DevTools contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Salesforce DevTools sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- login.salesforce.com
Salesforce DevTools sends data to login.salesforce.com. One other extension we have analysed sends data here.