Is Smartschool++ safe?

Smartschool++ ships plaintext third-party API keys and fetches server-supplied URLs without validation.

The extension bundles hardcoded API keys for OpenWeatherMap and the De Lijn public transit service directly in its background script, where any party who unpacks the CRX can read them. When a user installs a shared theme, the background service worker fetches a URL returned by theme.smpp.be without checking its origin or scheme, allowing the theme server to direct the extension to retrieve any URL reachable from the extension context, including localhost or intranet addresses.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.