Is Tabox - Save and Share Tab Groups safe?

Tabox ships a hardcoded Google OAuth client secret and Drive API key inside its extension package.

The extension bundles an api-keys.json file containing a Google OAuth client_secret and a Google Drive API key in plain text. Any user who installs the extension can read these credentials directly from the package. The client secret is used alongside each user's Google refresh token when the extension requests new access tokens from Google's OAuth endpoint.