Is Tab Session Manager safe?

Tab Session Manager bundles a hardcoded Google OAuth client_secret used to authenticate its Google Drive cloud-sync feature.

The extension stores tab sessions locally and optionally syncs them to Google Drive. To perform this sync, the background script includes a hardcoded OAuth client_id and client_secret that are sent to Google's token endpoint during the authorization code exchange. Because these credentials are embedded in the publicly distributed extension package, any party who downloads the XPI can extract them and impersonate the extension's OAuth application.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.