Is SingleFile safe?

SingleFile bundles hardcoded OAuth client secrets for Google Drive and Dropbox, and a hardcoded Woleet API bearer token, in its source.

The extension stores the developer's Google Drive and Dropbox OAuth client secrets as constants in its background script, where they are used to exchange refresh tokens during cloud save operations. It also includes a hardcoded fallback Woleet API bearer token (a signed JWT) used to anchor page hashes to a specific developer account when the user has not configured their own key. Anyone who extracts these values from the extension bundle can use the OAuth credentials to operate as the same registered OAuth application, or submit arbitrary blockchain anchors to the developer's Woleet account.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.