Is Salesforce OmniStudio Explorer safe?
Salesforce OmniStudio Explorer uses Salesforce session cookies to query OmniStudio package details after you open its popup.
When you ask the popup for org details, the extension reads the current Salesforce session cookie and matches it to a Salesforce or Cloudforce domain. It then uses that session as a bearer token for Salesforce REST and SOQL queries to retrieve API version and OmniStudio package metadata from the same Salesforce organization.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Act on the current tab, but only after you click the extension
activeTab
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed Salesforce OmniStudio Explorer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- *.salesforce.com
Salesforce OmniStudio Explorer sends data to *.salesforce.com. One other extension we have analysed sends data here.
- *.cloudforce.com
Salesforce OmniStudio Explorer sends data to *.cloudforce.com. No other extension we have analysed sends data here.